CVE-2026-93981 - hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
Brief
CVE ID : CVE-2026-93981
Published : Sept. 19, 2026, 12:16 p. m.
- 8 hours, 40 minutes ago
Description : hono before 4.
- 7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context. Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server.
These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
Severity: 4.7
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...