CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

Low 2.3 Published 19 Sep 2026 Updated 21 Sep 2026

Attackers can inject arbitrary HTML and execute scripts via unescaped strings in Hono's JSX server-side rendering paths.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-93981?

CVE-2026-93981 is a low-severity cross-site scripting vulnerability in honojs hono, published on 19 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Weakness: CWE-79

Which versions are affected by CVE-2026-93981?

2 open source packages ship an affected version, including hono.

Package	Affected	Fixed in
`hono` npm	All versions	`4.13.7`
`hono` npm	All versions	`4.13.7`

Linux distribution packages (1)

grafana12.4 Red Hat:hummingbird:1 All versions 0:12.4.10-0.10.hum1

How do I fix CVE-2026-93981?

Upgrade hono to 4.13.7 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-93981 being exploited?

There is no known exploitation of CVE-2026-93981 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-XJ89225, ECHO-5ad5-5923-2065, GHSA-hxh3-vqpv-xpqv, MINI-3ph3-599f-hv8f, MINI-56hv-h475-5428, MINI-67hq-97rc-m3m9 and 5 more.