Executive brief
Hono is a web framework used to build and serve websites. A vulnerability in its JSX component allows attackers to inject malicious HTML code if the application uses untrusted data to define website tag names. This could lead to the corruption of the website's appearance or the execution of unauthorized scripts in a user's browser, potentially compromising user sessions or data.
Technical details
A vulnerability exists in the hono/jsx component where element tag names are not properly validated or neutralized before being rendered into HTML strings. While attribute values and names are handled correctly, the `jsx()` and `createElement()` APIs allow raw, unvalidated tag names to be inserted into the output during server-side rendering. An attacker can exploit this by providing tag names containing special characters like `<`, `>`, quotes, or whitespace to break out of the intended element context. This can result in the injection of unintended HTML elements, attributes, or event handlers, potentially leading to Cross-Site Scripting (XSS). The vulnerability is patched in version 4.12.16.
Affected products
- honojs hono < 4.12.16
Timeline
- 2026-04-30: disclosed: Vulnerability reported to the maintainers.
- 2026-05-06: advisory: GitHub Advisory published.
- 2026-05-13: other: NVD published the CVE.