CVE-2026-93981— hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
Quick assessment
Affected
honojs hono
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hono 在 4.13.7 之前的版本中，在通过 渲染以下场景中的普通字符串时，未能对其进行 HTML 转义： 作为 的子节点或 fallback 内容； 作为 的字符串子节点，且该子节点与异步兄弟节点并列； 作为 的唯一子节点； 或作为通过 中的 或 传递的根级值。 在这些代码路径中，输入会被直接转换为字符串，并被当作“已转义的标记”处理。因此，在服务器端渲染过程中，如果攻击者能够控制其中某个字符串，就可以注入任意 HTML，从而在应用程序的源（origin）下执行脚本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93981
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
Source: CVE Program / CVE List V5
Vulnerability Description
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93981
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93981
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93981 (2)
IV. Related Vulnerabilities
Same product: hono
-
CVE-2026-84365
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still wri -
CVE-2026-84364
Hono: Unbounded dot-notation nesting in `parseBody()` can ca -
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, -
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-He -
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading t
Same vendor: honojs
-
CVE-2026-84365
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still wri -
CVE-2026-84364
Hono: Unbounded dot-notation nesting in `parseBody()` can ca -
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, -
CVE-2026-81888
@hono/oauth-providers: OAuth state check fails open on omitt -
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via abort
Same weakness: CWE-79
-
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via -
CVE-2026-1256
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missi -
CVE-2026-8354
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contribut -
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stor -
CVE-2026-15098
Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Sto
V. Comments for CVE-2026-93981
No comments yet