Description

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-19T12:16:41.080Z",
  "pubdate": "2026-09-19T12:16:41.080Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the hono/jsx rendering engine due to improper sanitization of string-based children during server-side rendering.\nThe vulnerability affects Hono versions prior to 4.13.7, specifically when processing string inputs within Suspense components, ErrorBoundary components, Context.Provider structures, or as root-level outputs in renderToString() and renderToReadableStream() from hono/jsx/dom/server.\nSuccessful exploitation allows an unauthenticated remote attacker to inject arbitrary HTML and execute malicious JavaScript within the security context of the user's session.\nThis vulnerability stems from the engine erroneously treating plain strings as pre-escaped markup during the stringification process, bypassing intended XSS protections.\nGiven that this flaw occurs during server-side rendering, an attacker controlling the input data can execute code at the origin level, potentially leading to session hijacking, data exfiltration, or unauthorized actions performed on behalf of authenticated users.\nThe risk is considered critical for applications utilizing dynamic inputs within these specific JSX rendering paths.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the stringification logic within the hono/jsx rendering engine. When specific JSX components and rendering functions (Suspense, ErrorBoundary, Context.Provider, renderToString, and renderToReadableStream) process inputs, they fail to apply necessary HTML-escaping routines to plain string children.\nInstead of treating these strings as raw text content that requires character encoding (e.g., converting '<' to '&lt;'), the rendering engine incorrectly assumes the input has already been sanitized and treats it as trusted, pre-formatted markup.\nThis failure occurs across several distinct paths: First, when a plain string is used as a child or fallback within a Suspense component. Second, when a string is used as a child of an ErrorBoundary alongside an asynchronous sibling. Third, when a string is provided as the single child of a Context.Provider. Finally, when a plain string is passed as the root value to renderToString() or renderToReadableStream() functions located in hono/jsx/dom/server.\nAn attacker can exploit this by providing a malicious string containing HTML tags (e.g., <script> or event handlers like onerror) into a component path that ultimately reaches one of these rendering sinks. Because the framework neglects the escaping stage, the injected payload is serialized directly into the server-rendered HTML response.\nThe attack flow proceeds as follows: 1) The attacker identifies an input vector that is reflected in the server-side rendered JSX output. 2) The attacker crafts a payload designed to break out of the HTML context. 3) The server application processes the input through one of the vulnerable Hono rendering sinks. 4) The rendering engine, failing to escape the string, inserts the raw malicious payload into the generated markup. 5) When the victim's browser receives and parses the malformed HTML, the injected scripts are executed in the application's origin.\nThis creates an environment where malicious scripts are executed with the full permissions of the original web page. This results in the ability to intercept cookies, access LocalStorage/SessionStorage, manipulate the DOM to present fraudulent UI elements, or perform actions as the victimized user, effectively bypassing the server-side security controls intended to neutralize client-side injections."
}