5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-56761

CVE-2026-56761: hono - HTML Injection via Improper JSX Attribute Name Handling in SSR

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-56761

CVE-2026-56761:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.14	4.12.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-458j-xx4x-4375, in Hono's JSX module is an HTML injection vulnerability caused by improper handling of attribute names during server-side rendering (SSR). The root cause is the lack of validation on attribute keys when rendering JSX elements to an HTML string. An attacker who can control the keys of attributes in a JSX element can inject malicious HTML, leading to potential Cross-Site Scripting (XSS).

The patch addresses this by introducing a new validation function, isValidAttributeName, in src/jsx/utils.ts. This function checks for invalid characters in attribute names that could be used for injection, such as quotes, angle brackets, and spaces.

This validation is then applied in two key vulnerable functions:

JSXNode.toString() in src/jsx/base.ts: This is the core of the SSR rendering logic. The patch ensures that any attribute with an invalid key is skipped during the serialization process.
jsxAttr() in src/jsx/jsx-runtime.ts: This helper function for creating attributes is also patched to validate the attribute key.

Additionally, the client-side DOM renderer is made more robust. The applyProps function in src/jsx/dom/render.ts is updated to catch exceptions that can occur when using invalid attribute names with setAttribute and removeAttribute, preventing potential rendering failures on the client side.

Vulnerable functions

JSXNode.toString

src/jsx/base.ts

The `toString` method of the `JSXNode` class is responsible for serializing a JSX component into an HTML string. The vulnerability lies in this method where it iterates through the component's properties (`props`) to create HTML attributes. Before the patch, the attribute name (`key`) was used to construct the HTML string without any validation. An attacker could provide a malicious string as a property key, which would then be rendered as part of the HTML, leading to HTML injection. The patch introduces the `isValidAttributeName` check to ensure that only valid attribute names are rendered.

jsxAttr

src/jsx/jsx-runtime.ts

The `jsxAttr` function is a helper for creating HTML attribute strings. It was vulnerable because it directly used the `key` argument to create the attribute string without validation. This allowed for the injection of malicious HTML if an attacker could control the `key`. The fix adds a call to `isValidAttributeName` to validate the key before it is used.

applyProps

src/jsx/dom/render.ts

The `applyProps` function is used in the client-side DOM renderer to apply properties as attributes to an HTML element. While the primary vulnerability is in server-side rendering, this function was also susceptible to issues with invalid attribute names. A malicious attribute name could cause `setAttribute` or `removeAttribute` to throw an `InvalidCharacterError`, potentially crashing the rendering process. The patch wraps these calls in a `try...catch` block to handle such errors gracefully, preventing a denial of service and ensuring rendering continues.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.