4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24771

CVE-2026-24771: Hono has a Cross-site Scripting vulnerability

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the ErrorBoundary component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24771

CVE-2026-24771:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.11.7	4.11.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ErrorBoundary component within src/jsx/components.ts. The provided commit patch clearly shows the remediation for a Cross-Site Scripting (XSS) vulnerability. The core of the issue was that the component would take its children or a fallback render result, convert them to strings, and then wrap the final output with the raw() utility. The raw() utility is a signal to the renderer to treat the string as pre-escaped, safe HTML, and thus render it directly without any further sanitization. This behavior could be exploited if an untrusted string, such as user input containing a script tag, was passed as a child to the ErrorBoundary or returned by the fallbackRender function. The patch addresses this by removing the usage of raw() on the collected children strings and instead wrapping the children and fallback results within a Fragment component. This delegates the rendering to the JSX engine, which correctly identifies and HTML-escapes any plain strings, thus neutralizing the XSS vector. The modified test file src/jsx/components.test.tsx further confirms this by adding assertions that check for correct HTML escaping of string content.

Vulnerable functions

ErrorBoundary

src/jsx/components.ts

The `ErrorBoundary` component was vulnerable to XSS because it would render its children and fallback content without proper HTML escaping. The component would concatenate any string children and wrap the final result in `raw()`, which explicitly prevents the renderer from escaping the content. This allowed a malicious string (e.g., `<script>alert(1)</script>`) passed as a child or through the `fallbackRender` prop to be executed as raw HTML in the browser. The patch fixes this by removing the `raw()` call and instead wrapping the content in a `Fragment`, which allows the JSX engine to correctly handle and escape string content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.