Hono Framework CVE-2026-47675

Exploitation requires two concrete conditions to hold simultaneously. First, the Hono application must pass user-controlled input directly or indirectly into the sameSite or priority parameter of the hono/cookie serialize() function - this is not a default framework behavior but an application-level pattern where, for instance, a cookie preference or locale value from a query parameter is forwarded into cookie options without sanitization. Second, the CVSS vector specifies UI:R (user interaction required), meaning a victim user must make an HTTP request that triggers the vulnerable code path - purely server-side or automated API consumers are not affected in the same way. Exploitation is limited by the unchanged scope (S:U): the attacker cannot leverage this to escape to a different security domain. Authentication is not required per PR:N in the CVSS vector. The vulnerability does not exist on systems running Hono 4.12.21 or later, or where user input is allowlisted before reaching cookie option parameters.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The network attack vector and low complexity confirm the exploit is reachable over the internet without elevated privileges, but the required user interaction (UI:R) constrains real-world impact - the victim's browser must make a request that triggers the vulnerable code path with attacker-supplied data. Scope is unchanged (S:U) and impact is limited to integrity (I:L), with no confidentiality or availability consequences per CVSS. No EPSS data was supplied in the intelligence feed; given no KEV listing and no known public exploit code, opportunistic mass exploitation appears unlikely. The realistic risk concentrates on applications that explicitly reflect user-provided input (query parameters, form fields, path segments) into sameSite or priority cookie options - a non-default but plausible application pattern. The absence of a vendor advisory URL beyond the GitHub GHSA advisory limits independent verification of exploitability details.

An attacker crafts a URL or form payload containing a malicious string such as 'None; Secure; Set-Cookie: session=attacker_value' and delivers it to a victim via phishing or a malicious link. When the victim's browser follows the link, the target application reflects the attacker-supplied value into the priority or sameSite option of a cookie being set via Hono's serialize(), producing a corrupted Set-Cookie header containing the injected attributes. No public proof-of-concept code exists at time of analysis, but the low complexity of the injection technique makes reproduction straightforward for a skilled attacker.