CVE-2026-56761

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-06-24

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• hono:hono

Packages (OSV)

References

• https://github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375
• https://www.vulncheck.com/advisories/hono-html-injection-via-improper-jsx-attribute-name-handling-in-ssr

Check your stackJSON