CVE-2026-93981 Details
Description
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
A cross-site scripting vulnerability has been identified in Hono versions prior to 4.13.7. The issue arises because the Hono JSX rendering engine fails to properly HTML-escape plain strings in certain contexts during server-side rendering. Specifically, unescaped strings can be injected as children or fallbacks of Suspense components, as string children of ErrorBoundary components alongside asynchronous siblings, as the sole child of Context.Provider components, or as the root value in server-side rendering functions. This flaw allows an attacker to inject arbitrary HTML and execute scripts under the application's origin.
Users can upgrade to Hono version 4.13.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono | < 4.13.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |