CVE-2026-59895CWE-116CWE-79

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Medium · published July 8, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.6th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-08T16:09Z
EPSS history
Timeline
  • 08 JUL 16:09Z
    Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
    cvelistv5