Executive brief
hono is a popular web framework for building server-side rendered applications with JSX. The framework fails to validate JSX attribute names during HTML generation, allowing attackers to inject malicious HTML attributes or elements if they can control attribute keys. This vulnerability could enable attackers to alter page content, inject scripts, or trick users through crafted HTML output.
Technical details
The vulnerability exists in hono's JSX SSR implementation where attribute values are escaped but attribute names (keys) are inserted into HTML output without validation. When untrusted input is used as JSX attribute keys, malformed keys containing special characters like double quotes ("), angle brackets (>), or whitespace can break out of attribute boundaries or tag boundaries to inject unintended HTML. An attacker controlling attribute keys during server-side rendering can inject unexpected attributes, corrupt HTML structure, or potentially enable XSS attacks when combined with unsafe usage patterns. The vulnerability affects all versions prior to 4.12.14, where the fix validates and sanitizes attribute names before insertion into the HTML output. Attack vector is network-based, requires user interaction, and does not require elevated privileges.
Affected products
- honojs hono before 4.12.14
Timeline
- 2026-04-16: disclosed: GHSA-458j-xx4x-4375 published
- 2026-04-16: patched: Fixed in hono 4.12.14