Executive brief
Hono is a web framework that includes a JSX rendering engine for server-side HTML generation. Versions before 4.13.7 fail to properly escape plain strings in certain contexts (Suspense boundaries, error handlers, and context providers), allowing attackers who control input strings to inject malicious HTML and JavaScript that executes in users' browsers. This can lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in hono/jsx's server-side rendering where certain code paths treat string input as pre-escaped HTML markup without performing HTML entity encoding. Affected paths include Suspense fallbacks, ErrorBoundary children with async siblings, single Context.Provider children, and root values passed to renderToString() or renderToReadableStream() in hono/jsx/dom/server. An attacker who controls a string rendered in these positions during server-side rendering can execute arbitrary script under the application origin; client-side rendering and strings wrapped in elements are not affected.
Affected products
- Hono Hono before 4.13.7
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 4.13.7 released