CVE-2026-93981 | BDVDB-2026-377151 Detail

Description#

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-19Record published in the CVE List.
2. Version 22026-09-21Most recent update recorded in the CVE List.