PT-2026-51785 · Hono · Hono

Tndud042713 · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-56761

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56761

Affected Products

Hono

References · 3

• https://github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56761 · Security Note
• https://vulncheck.com/advisories/hono-html-injection-via-improper-jsx-attribute-name-handling-in-ssr · Note