Read the docs
TI-2026-63240 Aliases CVE-2026-93981GHSA-hxh3-vqpv-xpqv

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

Priority LOW 11CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Partial hono (honojs): 4.13.7hono (npm): 4.13.7Red Hat: 4 advisoriesRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
honojshonobefore 4.13.74.13.7Patch availableCNA
—hono (npm)before 4.13.74.13.7Patch availableGHSA-hxh3-vqpv-xpqv
  • hono Vendorhonojs Affected before 4.13.7 Fixed in 4.13.7 Patch available CNA
  • hono (npm) Vendor— Affected before 4.13.7 Fixed in 4.13.7 Patch available GHSA-hxh3-vqpv-xpqv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*——honojs
  • cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

  • Fix · CNA hono (honojs) Fixed in 4.13.7
  • Fix · GHSA-hxh3-vqpv-xpqv hono (npm) Fixed in 4.13.7 Advisory →

Red Hat 4 advisories

  • RHSA-2026:74869 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.6.hum1@aarch64, grafana13.1-13.1.6-0.6.hum1@src, grafana13.1-13.1.6-0.6.hum1@x86_64
  • RHSA-2026:73655 Released 2026-09-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.5.hum1@aarch64, grafana13.1-13.1.6-0.5.hum1@src, grafana13.1-13.1.6-0.5.hum1@x86_64
  • RHSA-2026:73654 Released 2026-09-30 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.10-0.10.hum1@aarch64, grafana12.4-12.4.10-0.10.hum1@src, grafana12.4-12.4.10-0.10.hum1@x86_64
Show 1 more Red Hat advisories
  • RHSA-2026:71906 Released 2026-09-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.7.hum1@aarch64, grafana13.2-13.2.1-0.7.hum1@src, grafana13.2-13.2.1-0.7.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:71906, RHSA-2026:73654, RHSA-2026:73655, RHSA-2026:74869

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93981
  2. 2026-10-03 Alias added: GHSA-hxh3-vqpv-xpqv

References

Advisory 2

Other 3

  • TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
  • TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
  • TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
  • TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
  • TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
  • TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences