CyberRota Analysis
AI-GeneratedThe Hono web application framework for JavaScript runtimes is vulnerable due to improper handling of untrusted className values in JSX class attributes during server-side rendering, which can lead to arbitrary markup injection. This flaw poses a medium severity risk, particularly for developers using versions prior to 4.12.27, as it could allow attackers to manipulate the rendered output. Organizations utilizing affected versions should prioritize upgrading to the patched version to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.
Related CVEs
Other vulnerabilities affecting the same vendor(s)