Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Vulnerability Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Vulnerability Type
CWE-1113
Vulnerability Title
Hono 安全漏洞
Vulnerability Description
Hono是Hono社区的一个用 TypeScript 编写的 Web 框架。 Hono 4.12.4之前版本存在安全漏洞，该漏洞源于setCookie工具在构建Set-Cookie标头时未验证域和路径选项中的分号、回车或换行符，可能导致注入额外的cookie属性。
CVSS Information
N/A
Vulnerability Type
N/A