PT-2026-56505 · Honojs · Hono

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-59895

Mitre

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.

Correção

XSS

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-79

CWE-116

Identificadores relacionados

CVE-2026-59895

Produtos afetados

Hono

Referências · 4

• https://github.com/honojs/hono/releases/tag/v4.12.27 · Nota
• https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59 · Nota
• https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59895 · Nota de Segurança