Is there a patch available for EUVD-2026-38757?

Yes, a patch is available for EUVD-2026-38757. Update the affected software to the latest version immediately.

Hono EUVD-2026-38757

Q: What is the CVSS score of EUVD-2026-38757?

EUVD-2026-38757 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-56761 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 VulnCheck

XSS Hono

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered, no auth needed (PR:N), but requires victim to load the page (UI:R); scope changes to browser context (S:C) enabling XSS with low C and I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 13:01 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 12:26 vuln.today

Analysis Generated

Jun 24, 2026 - 12:26 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

31 npm packages depend on hono (28 direct, 3 indirect)

Ecosystem-wide dependent count for version 4.12.14.

DescriptionCVE.org

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

AnalysisAI

HTML injection in Hono's JSX server-side rendering engine (versions before 4.12.14) allows network-accessible attackers to corrupt rendered HTML output by supplying malformed attribute names containing characters such as quotes or angle brackets. Applications that pass untrusted external input - query parameters, form data, or other user-controlled values - directly as JSX attribute keys during SSR are affected. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; however, successful exploitation against vulnerable application patterns can escalate to cross-site scripting if the injected HTML includes event handlers processed by the victim's browser.

Technical ContextAI

Hono is a lightweight TypeScript/JavaScript web framework targeting edge runtimes including Cloudflare Workers, Deno, and Bun, with widespread use via the npm registry (CPE: cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*). The hono/jsx subsystem renders JSX component trees into HTML strings for server-side delivery. The root cause, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS), is an asymmetric sanitization defect: attribute values were properly escaped, but attribute name keys were inserted verbatim into the generated HTML without any character validation. Characters such as double quotes ("), right angle brackets (>), and whitespace carry structural significance in HTML serialization; when present in an attribute key position, they can terminate the current attribute context, inject additional attributes, or close the enclosing tag entirely and introduce sibling elements. This is a classic server-side template injection pattern manifesting in a JSX-to-HTML serializer rather than a traditional template engine.

RemediationAI

Upgrade the hono npm package to version 4.12.14 or later, which introduces attribute key validation during JSX-to-HTML serialization (npm install hono@4.12.14 or yarn add hono@4.12.14). This is the only confirmed fix; the vendor advisory at https://github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375 confirms this release resolves the issue. As an immediate compensating control where patching is delayed, audit all SSR rendering code paths and ensure that no externally-sourced values (query parameters, path segments, headers, form fields, database-backed user content) are used as JSX attribute keys; restricting attribute keys to compile-time static strings eliminates the attack surface entirely with no functional trade-off. There is no known configuration-level workaround that preserves the ability to use dynamic attribute keys safely without the patch.