CVE-2026-93981: hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
Affected Software
Event History
Frequently Asked Questions
Which rendering patterns are affected?
The issue affects plain strings rendered as a child or Suspense fallback, as a string child of an ErrorBoundary with an asynchronous sibling, as the sole child of a Context.Provider, or as the root value supplied to renderToString() or renderToReadableStream() from hono/jsx/dom/server.
What must an attacker control to exploit this?
An attacker must be able to control a string that reaches one of the affected server-side rendering paths. The string is then treated as already-escaped markup, allowing injected HTML and script execution under the application's origin.
Are applications using other JSX rendering patterns affected?
The provided information identifies only the listed string-rendering paths. It does not state that all hono/jsx rendering of strings is affected.