GHSA-9r54-q6cx-xmh5

Suggest an improvement
Source
https://github.com/advisories/GHSA-9r54-q6cx-xmh5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-9r54-q6cx-xmh5/GHSA-9r54-q6cx-xmh5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9r54-q6cx-xmh5
Aliases
Downstream
CGA (22)
MINI (2)
Published
2026-01-28T16:10:22Z
Modified
2026-09-10T03:50:32Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Hono vulnerable to XSS through ErrorBoundary component
Details

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the ErrorBoundary component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser.

Details

The issue is in the ErrorBoundary component (src/jsx/components.ts). ErrorBoundary previously forced certain rendered output paths to be treated as raw HTML, bypassing the library's default escaping behavior. This could result in unescaped rendering when developers pass user-controlled strings directly as children, or when fallbackRender returns user-controlled strings (for example, reflecting error messages that contain attacker input).

This vulnerability is only exploitable when an application renders untrusted user input within ErrorBoundary without appropriate escaping or sanitization.

Impact

Successful exploitation may allow attackers to execute arbitrary JavaScript in the victim’s browser (reflected XSS). Depending on the application context, this can lead to actions such as session compromise, data exfiltration, or performing unauthorized actions as the victim.

Affected Components

  • hono/jsx: ErrorBoundary component
Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-28T16:10:22Z",
    "nvd_published_at":  "2026-01-27T20:16:24Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / hono

Package

Name
hono
View open source insights on deps.dev
Purl
pkg:npm/hono

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.11.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-9r54-q6cx-xmh5/GHSA-9r54-q6cx-xmh5.json"