CVE-2026-59895 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.
A Cross-Site Scripting (XSS) vulnerability has been identified in the Hono web application framework, specifically in versions 4.0.0 prior to 4.12.27. The issue arises in the 'cx()' function within the 'hono/css' module, which composes class names from plain strings. The function incorrectly marks the output as HTML-escaped without properly escaping the input. This flaw allows untrusted class name values, when used in a JSX class attribute during server-side rendering, to escape the attribute context and inject arbitrary markup. Exploitation of this vulnerability could lead to XSS, with the injected script executed in the context of the user's browser session, potentially causing session hijacking or credential theft.
Upgrade to Hono version 4.12.27 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono hono | >= 4.0.0, < 4.12.27 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |