hono/jsx renders plain strings unescaped in boundary components, leading to XSS.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary , as the only child of a Context.Provider , or as the root value of renderToString() / renderToReadableStream() from hono/jsx/dom/server . Such a string is emitted as markup instead of text. Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - Suspense : a string child, or a string fallback while a child suspends. With streaming, the fallback reaches the browser in the initial chu
Timeline
30 Sep- Published by GitHub advisory database30 Sep
- Seen by Patchwire23 Oct
- Fix released30 Sep
Versions of hono
Related alerts(1)
Same packagesSource summary
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configure
- Affected
- hono >=4.12.4 <4.13.11
- Fixed in
- 4.13.11
- ID
- GHSA-5r4p-p66f-jhc7