{"items":[{"id":"NVI-00017687","kind":"vulnerability","title":"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-458j-xx4x-4375","CVE-2026-56761"],"plain_summary":"GitHub lists this reviewed advisory for hono. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-457fe4d611922011d379a6c5b5769038"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-24T13:10:58.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-457fe4d611922011d379a6c5b5769038"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-457fe4d611922011d379a6c5b5769038","url":"https://github.com/advisories/GHSA-458j-xx4x-4375","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-458j-xx4x-4375","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:06:16.668Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-457fe4d611922011d379a6c5b5769038"],"technology":"hono","known_exclusions":[],"conditions_summary":"## Summary\n\nImproper handling of JSX attribute names in hono/jsx allows malformed attribute keys to corrupt the generated HTML output.\n\nWhen untrusted input is used as attribute keys during server-side rendering, specially crafted keys can break out of attribute or tag boundaries and inject unintended HTML.\n\n## Details\n\nWhen rendering JSX elements to HTML strings, attribute values are escaped, but attribute names (keys) were previously inserted into the output without validation.\n\nIf an attribute name contains characters such as `\"`, `>`, or whitespace, it can alter the structure of the generated HTML.\n\nFor example, malformed attribute names can:\n\n* Break out of the current attribute and introduce unintended additional attributes\n* Break out of the current HTML tag and inject new elements into the output\n\nThis issue arises when untrusted input (such as query parameters or form data) is used as JSX attribute keys during server-side rendering.\n\n## Impact\n\nAn attacker who can control attribute keys used in JSX rendering may inject unintended attributes or HTML elements into the generated output.\n\nThis may lead to:\n\n* Injection of unexpected HTML attributes\n* Corruption of the HTML str","public_affected_ranges":["< 4.12.14"]}],"null_published_at":"2026-11-05T19:10:21.451Z","source_updated_at":"2026-06-24T13:10:58.000Z","source_disclosed_at":"2026-04-16T01:02:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:06:16.668Z"}],"next_cursor":null,"snapshot_revision":"42594"}