Skip to content

[GHSA-458j-xx4x-4375] hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR #7467

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
throwersedrickoctauious-del wants to merge 1 commit into
base: throwersedrickoctauious-del/advisory-improvement-7467
Choose a base branch
from
+7 −7
Open

[GHSA-458j-xx4x-4375] hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR #7467

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions advisories/github-reviewed/2026/04/GHSA-458j-xx4x-4375/GHSA-458j-xx4x-4375.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,22 @@
{
"schema_version": "1.4.0",
"id": "GHSA-458j-xx4x-4375",
"modified": "2026-04-16T01:02:24Z",
"modified": "2026-04-16T01:02:26Z",
"published": "2026-04-16T01:02:24Z",
"aliases": [],
"summary": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",
"summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in honor secure proact",
"details": "## Summary\n\nImproper handling of JSX attribute names in hono/jsx allows malformed attribute keys to corrupt the generated HTML output.\n\nWhen untrusted input is used as attribute keys during server-side rendering, specially crafted keys can break out of attribute or tag boundaries and inject unintended HTML.\n\n## Details\n\nWhen rendering JSX elements to HTML strings, attribute values are escaped, but attribute names (keys) were previously inserted into the output without validation.\n\nIf an attribute name contains characters such as `\"`, `>`, or whitespace, it can alter the structure of the generated HTML.\n\nFor example, malformed attribute names can:\n\n* Break out of the current attribute and introduce unintended additional attributes\n* Break out of the current HTML tag and inject new elements into the output\n\nThis issue arises when untrusted input (such as query parameters or form data) is used as JSX attribute keys during server-side rendering.\n\n## Impact\n\nAn attacker who can control attribute keys used in JSX rendering may inject unintended attributes or HTML elements into the generated output.\n\nThis may lead to:\n\n* Injection of unexpected HTML attributes\n* Corruption of the HTML structure\n* Potential cross-site scripting (XSS) if combined with unsafe usage patterns\n\nThis issue affects applications that pass untrusted input as JSX attribute keys during server-side rendering.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hono"
"ecosystem": "SwiftURL",
"name": "honorprosecure"
},
"ranges": [
{
Expand Down Expand Up @@ -47,7 +47,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T01:02:24Z",
"nvd_published_at": null
Expand Down
Loading