What is the CVSS score of CVE-2026-59895?

CVE-2026-59895 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-59895?

Yes, a patch is available for CVE-2026-59895. Update the affected software to the latest version immediately.

Hono CVE-2026-59895

EUVD-2026-42327 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 GitHub_M

GHSA-w62v-xxxg-mg59

XSS Red Hat Hono Honojs

6.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Scope:Changed because SSR injection crosses to victim browser; PR:N as attacker only supplies untrusted input; UI:R since victim must load the rendered page; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 18:02 EUVD

Analysis Generated

Jul 08, 2026 - 17:15 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on hono (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.

AnalysisAI

Server-side rendering XSS in Hono's hono/css module (versions 4.0.0 through 4.12.26) allows injection of arbitrary HTML markup by exploiting the cx() function's failure to HTML-escape input before marking it as safe. When untrusted data flows into a cx() call used in a JSX class attribute during SSR, attackers can break out of the attribute context and inject arbitrary markup or script into the rendered page delivered to victims. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 6.1 Medium score with Scope:Changed reflects the cross-context server-to-browser impact.

Technical ContextAI

Hono (CPE: cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*) is a lightweight web framework designed to run across multiple JavaScript runtimes (Cloudflare Workers, Deno, Bun, Node.js, etc.). The hono/css module exposes a cx() utility for composing CSS class name strings in JSX components. During server-side rendering, Hono serializes JSX to HTML and relies on an internal escaping pipeline to sanitize dynamic values. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is that cx() prematurely marks its composed output as already-escaped - bypassing the escaping pipeline - without first sanitizing the input strings. If any argument to cx() contains HTML metacharacters such as quotes or angle brackets, they pass through to the serialized HTML verbatim, enabling attribute breakout and injection of arbitrary content into the victim's browser.

RemediationAI

Upgrade Hono to version 4.12.27 or later, which resolves the improper escaping in cx() per the GitHub release at https://github.com/honojs/hono/releases/tag/v4.12.27. The specific fix is available in commit cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc (https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc). If an immediate upgrade is not feasible, the most effective compensating control is to audit all call sites of cx() in JSX class attributes and ensure no untrusted or user-controlled data is passed as an argument - replacing such patterns with explicit allow-list validation or manual HTML encoding before the value reaches cx(). Note that manual escaping is error-prone and introduces maintenance burden; it should be treated as a temporary measure only. Upgrading to 4.12.27 is the authoritative fix.