{"uuid": "144d32c7-ae01-4894-9ff1-2cfe766b7b20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93981", "type": "seen", "source": "https://gist.github.com/alon710/f943130458d0f89efe7850a36aaddaa7", "content": "# CVE-2026-93981: CVE-2026-93981: Cross-Site Scripting via Unescaped SSR Pathways in Hono JSX Engine\n\n> **CVSS Score:** 4.7\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-93981\n\n## Summary\nAn improper neutralization of input during web page generation (CWE-79) vulnerability exists in the server-side rendering JSX engine (hono/jsx) of the Hono web framework prior to version 4.13.7. The flaw enables unauthenticated remote attackers to execute arbitrary JavaScript in the victim's browser context by supplying unescaped HTML characters into user-controlled fields rendered within specific boundary components, context providers, or direct server-side utilities.\n\n## TL;DR\nA critical vulnerability in Hono's JSX rendering engine allows unescaped user inputs to bypass HTML serialization. Attackers can inject arbitrary script payloads into Suspense, ErrorBoundary, Context.Provider, or direct render pipelines, resulting in unauthenticated Cross-Site Scripting.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.7 (Medium)\n- **EPSS Score**: 0.00227\n- **EPSS Percentile**: 12.17%\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Hono Web Framework (hono/jsx) versions prior to 4.13.7\n- **Hono**: >= 0, < 4.13.7 (Fixed in: `4.13.7`)\n\n## Mitigation\n\n- Upgrade the Hono framework dependency in package configurations to version 4.13.7 or higher.\n- Implement robust schema validation on incoming request parameters using libraries like Zod to block unexpected HTML sequences.\n- Sanitize output contexts manually if using custom string-building mechanisms alongside framework rendering engines.\n- Configure strict Content Security Policies (CSP) to restrict JavaScript execution to trusted origins and block inline script blocks.\n\n**Remediation Steps:**\n1. Open the project package.json and verify the Hono dependency version under the dependencies section.\n2. Execute the update command to fetch and install the secure release: npm install hono@4.13.7\n3. Inspect lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to confirm that transitive dependencies resolve to version 4.13.7 or higher.\n4. Rebuild and redeploy the application to serverless platforms, edge runners, or containerized environments.\n\n## References\n\n- [GHSA-hxh3-vqpv-xpqv: XSS vulnerability in hono/jsx](https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv)\n- [NVD - CVE-2026-93981 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-93981)\n- [CVE-2026-93981 Record](https://www.cve.org/CVERecord?id=CVE-2026-93981)\n- [Hono Fix Commit 2b8ed402cdab](https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e)\n- [Hono v4.13.7 Release Notes](https://github.com/honojs/hono/releases/tag/v4.13.7)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-93981) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T08:30:30.000000Z"}