CVE-2026-93981

Deferred Deferred - Pending Action

Hono JSX Server-Side XSS via Unescaped String Rendering

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93981

Affected Vendors & Products

Vendor	Product	Version / Range
hono	hono	to 4.13.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

hono before version 4.13.7 does not properly escape plain strings when rendered by hono/jsx in specific contexts. This includes strings rendered as children of Suspense, ErrorBoundary, Context.Provider, or when passed to renderToString() or renderToReadableStream(). The issue occurs because these paths treat stringified input as already-escaped markup, allowing attackers who control such strings to inject arbitrary HTML and execute scripts in the application's context.

Impact Analysis

This vulnerability could allow an attacker to inject malicious scripts into web pages served by your application. If exploited, it may lead to unauthorized data access, session hijacking, or defacement of your website. Users could be redirected to phishing sites or have their interactions manipulated without their knowledge.

Compliance Impact

This vulnerability could lead to violations of GDPR or HIPAA if it results in unauthorized access to personal or health data. GDPR requires protection against data breaches, while HIPAA mandates safeguards for protected health information. Exploitation could trigger reporting obligations and potential fines under these regulations.

Mitigation Strategies

Upgrade Hono to version 4.13.7 or later to address the HTML-escaping flaw in server-side rendering paths.

Hi! I’m here to help you understand CVE-2026-93981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70