{"id":"CVE-2026-93981","aliases":["CLSA-2026-1790854808","EUVD-2026-83586","GHSA-6623-4q32-82v8","GHSA-hxh3-vqpv-xpqv","RHSA-2026:71906","RHSA-2026:73654","RHSA-2026:73655","RHSA-2026:74869"],"status":"published","title":"hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00227,"percentile":0.13619,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-09-19T11:53:34Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.13.7"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","fixed_in":["0:12.4.10-0.10.hum1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.12-tuxcare.0"},{"fixed":"3.12.12-tuxcare.3"}]}],"versions":["3.12.12","3.12.12-tuxcare.1","3.12.12-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.13.7"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.7.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.10.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.5.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.6.hum1"}]}],"bundled":12}],"products":[{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","tags":["vendor-advisory","advisory","web","article"]},{"url":"https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings","tags":["third-party-advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6623-4q32-82v8"},{"url":"https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","tags":["web"]},{"url":"https://github.com/honojs/hono/releases/tag/v4.13.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71906","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86472","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93981","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71906.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","tags":["advisory"]},{"url":"https://github.com/go-openapi/swag","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","tags":["article"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","tags":["article"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93981","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73654","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73654.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73655","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81842","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76154","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73655.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76154","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81842","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-81842","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101903","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101898","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101907","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101909","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101908","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101900","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101905","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101902","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101901","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101904","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74869.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","tags":["article"]},{"url":"https://github.com/axios/axios/pull/11141","tags":["article"]},{"url":"https://github.com/axios/axios/releases/tag/v1.20.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","tags":["advisory"]},{"url":"https://github.com/axios/axios/releases/tag/v0.34.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101907","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-93981","title":"hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"published","published":"2026-09-19T11:53:34.294Z","modified":"2026-09-21T20:47:06.182Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-83586","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"published","published":"2026-09-19T11:53:34Z","modified":"2026-09-21T20:47:06Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T17:28:04.224689Z"}],"ghsa":[{"id":"GHSA-6623-4q32-82v8","title":"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references.\n\n## Original Description\nhono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"withdrawn","published":"2026-09-19T12:32:10Z","modified":"2026-09-30T23:46:02Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:23.783773Z"},{"id":"GHSA-hxh3-vqpv-xpqv","title":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","description":"### Summary\n\n`hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text.\n\n### Details\n\nThese paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases:\n\n- `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches the browser in the initial chunk.\n- `ErrorBoundary`: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5).\n- `Context.Provider`: a single string child. Multiple children are escaped.\n- `hono/jsx/dom/server`: a string, or an array containing strings, passed as the root.\n\nA lone `{children}` forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from `raw()` or the `html` helper, and client-side rendering with `hono/jsx/dom` are not affected.\n\n### Impact\n\nAn attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin.\n\nThis issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.","status":"published","published":"2026-09-30T23:46:16Z","modified":"2026-09-30T23:46:17Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-93981","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"published","published":"2026-09-19T12:16:41.08Z","modified":"2026-09-21T21:17:20.74Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"CVE-2026-93981","title":"hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings","description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"published","published":"2026-09-19T11:53:34.294Z","modified":"2026-10-28T02:30:31.001017607Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-6623-4q32-82v8","title":"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references.\n\n## Original Description\nhono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","status":"withdrawn","published":"2026-09-19T12:32:10Z","modified":"2026-10-01T00:00:05.652739792Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"GHSA-hxh3-vqpv-xpqv","title":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","description":"### Summary\n\n`hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text.\n\n### Details\n\nThese paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases:\n\n- `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches the browser in the initial chunk.\n- `ErrorBoundary`: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5).\n- `Context.Provider`: a single string child. Multiple children are escaped.\n- `hono/jsx/dom/server`: a string, or an array containing strings, passed as the root.\n\nA lone `{children}` forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from `raw()` or the `html` helper, and client-side rendering with `hono/jsx/dom` are not affected.\n\n### Impact\n\nAn attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin.\n\nThis issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.","status":"published","published":"2026-09-30T23:46:16Z","modified":"2026-10-01T00:00:05.750907953Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"RHSA-2026:71906","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-26T10:12:41Z","modified":"2026-10-20T10:43:37.252640927Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73654","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:20:59Z","modified":"2026-10-10T10:20:55Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:20:59Z","modified":"2026-10-10T10:20:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74869","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-03T10:17:00Z","modified":"2026-10-10T10:21:33Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"CLSA-2026-1790854808","title":"TuxCare security update for hono (2 CVEs)","description":"TuxCare rebuilt hono to address 2 CVEs. Fixed in 3.12.12-tuxcare.3.","status":"published","published":"2026-10-01T11:40:08Z","modified":"2026-10-15T09:47:57.771950419Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}