PT-2026-38318 · Hono · Hono
Published
2026-05-06
·
Updated
2026-05-18
·
CVE-2026-44455
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Hono versions prior to 4.12.16
Description
Improper handling of JSX element tag names in hono/jsx allows unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic
jsx() or createElement() functions during server-side rendering, specially crafted values can break out of the intended element context and inject unintended HTML. While attribute values are escaped and attribute names are validated, element tag names were inserted without validation. If a tag name contains characters such as <, >, quotes, or whitespace, it may alter the HTML structure, introduce unexpected elements, or inject attributes and event handlers. This can lead to corruption of the HTML structure or Cross-site scripting (XSS), which is a technique where malicious scripts are injected into otherwise trusted websites.Recommendations
Update to version 4.12.16.
As a temporary workaround, avoid using untrusted input as tag names in the
jsx() or createElement() functions.Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hono