CVE-2026-59895: Hono cx() HTML Injection in Server-Side Rendering

Technical summary

The cx() function in the hono/css module composes multiple class name strings into a single class attribute value. The vulnerability stems from a logic error where the function concatenates untrusted className inputs but then flags the result as pre-escaped HTML (using a trusted markup marker) without performing any HTML entity encoding on those inputs. During server-side rendering, JSX processes the class attribute using this marked-safe string directly, bypassing normal escaping mechanisms. An attacker who controls className values—such as through user input, database records, or API responses—can inject sequences like " onload="alert(1) or other HTML/JavaScript payloads that break out of the attribute context and execute in the rendered document.

Business impact

Applications using Hono for server-side rendering with untrusted class name sources face reflected or stored cross-site scripting (XSS) risk. If user input flows into JSX className attributes without sanitization, attackers can inject scripts that execute in end-user browsers, potentially stealing session cookies, performing unauthorized actions on behalf of victims, redirecting users, or defacing content. The severity is medium rather than high because successful exploitation requires user interaction (clicking a link with malicious parameters or visiting a compromised page) and depends on how the application architecture sources className values. However, any publicly-exposed Hono application that renders user-controlled strings as class names is at risk.

Affected systems

The vulnerability affects Hono framework versions 4.0.0 through 4.12.26 inclusive. Any application using those versions and employing the cx() utility from hono/css with untrusted or user-supplied className inputs during server-side rendering is vulnerable. This includes applications that pass user input, query parameters, form data, or other external sources into JSX className attributes.

Exploitability

Exploitation is straightforward if an application passes untrusted input to cx() in a JSX class attribute. An attacker can craft a className string containing quote characters followed by HTML event handlers or tag closures (e.g., '" onmouseover="alert(1)') that break attribute boundaries and inject executable markup. The attack requires user interaction (visiting a malicious link or viewing injected content) but no special privileges, authentication, or complex environment setup. The network vector and low complexity make this readily exploitable in real-world scenarios where class names derive from user input.

Remediation

Immediately upgrade Hono to version 4.12.27 or later, which properly escapes input passed to cx() before marking it as safe HTML. Additionally, implement input validation and sanitization at the application layer: validate className values against a whitelist of expected class names, reject or sanitize user-supplied strings before passing them to cx(), and consider using Content Security Policy (CSP) headers to limit the impact of any injected scripts. Review your application code for all places where cx() or similar utilities receive untrusted input.

Patch guidance

Update the Hono dependency to version 4.12.27 or any later release. If using a package manager such as npm, yarn, or pnpm, run `npm install hono@latest` (or equivalent for your manager) and rebuild your application. Verify the updated version is active in your lock file and perform a test build to ensure no compatibility breaks. For pinned or locked dependencies, explicitly update the version constraint to >=4.12.27 before re-installing.

Detection guidance

Search your codebase for uses of cx() from hono/css, particularly in JSX components that receive className props or values from external sources (environment variables, API responses, user input, database queries). Monitor server-side rendering logs and HTTP responses for suspicious class attribute values containing quotes, event handlers, or script tags. Use static analysis tools or linters configured to flag instances where cx() is called with unsanitized variables. Additionally, review Content Security Policy violation reports or browser XSS filter logs for patterns indicating markup injection attempts.

Why prioritize this

Although rated CVSS 6.1 (MEDIUM), this vulnerability warrants high priority for any public-facing Hono application that renders untrusted input. The combination of low attack complexity, no authentication requirement, network vector, and broad potential impact (confidentiality and integrity compromise through XSS) makes it practically dangerous. The fix is straightforward (a version upgrade), and the risk window is significant for unpatched systems. Prioritize patching systems that expose user-controlled input through web interfaces.

Risk score, explained

The CVSS 6.1 score reflects a network-accessible flaw requiring user interaction, affecting confidentiality and integrity but not availability. The scope is marked as changed (affecting resources beyond the vulnerable component), elevating severity beyond the base impact. However, the score is not higher because XSS vulnerabilities typically require user interaction (clicking a link, viewing content) and the damage is limited to the victim's session rather than server-wide compromise. Organizations should treat this as a medium-to-high priority based on their attack surface and the presence of untrusted class name sources in their Hono applications.

Frequently asked questions