CVE-2026-59895: hono Cross-site Scripting
CVSS: 6.1v3.1MediumAnalyzed
AliasesCGA-c326-xv62-3632CGA-rjpg-65g4-wq56CGA-w8v7-6wrp-qxpmGHSA-w62v-xxxg-mg59CGA-27p7-xrwm-q5h9CGA-3vc5-f3ww-rvhvCGA-3w5r-75jj-xvjfCGA-4796-hxcm-fp25CGA-4jqx-x3g6-x423CGA-56g2-mr2j-6qmvCGA-57j9-6pqc-44whCGA-5fm9-mcjm-vrxxCGA-5g39-966w-xj5rCGA-5g7p-c578-h97gCGA-62rv-2chp-vcq3CGA-6gqg-p7r6-crxqCGA-6mfm-3cqm-4mf8CGA-6mq2-gj3h-cgrfCGA-6vm7-756f-jr3pCGA-7gc7-826v-j9jpCGA-7m39-c668-vmwcCGA-7qmq-2w58-7fjxCGA-7vrp-xq44-8ww2CGA-836w-vgxr-8r45CGA-86q6-3w7g-2p88CGA-8938-h88m-95ggCGA-8xpr-3gg3-43g4CGA-92rp-r7xp-rg2vCGA-95g5-526x-hrrmCGA-95xj-gm9j-42wxCGA-9hm9-8ff8-h8xfCGA-c483-6pfc-24qcCGA-c84c-7w9h-jcr9CGA-cvcm-mfxw-4gxqCGA-f5f6-3pw2-44m5CGA-fm88-jvgj-cww5CGA-g2v8-cg2g-q887CGA-g438-x27w-g5hmCGA-g7f4-c2vw-29fwCGA-gh4p-99c7-chv5CGA-ghfc-w9xr-9m83CGA-h33q-42xw-j6wpCGA-h43j-m4mx-g8w8CGA-h6gg-jhjx-6rm5CGA-h7m4-f87w-5gjvCGA-h9hc-rq2w-7353CGA-hgw2-p7g6-h7r3CGA-hvx8-59vr-mj65CGA-jcph-pmhg-84v5CGA-jg3j-7q6v-fhg4CGA-jhrx-9888-fm2xCGA-jmxf-4457-84q5CGA-mr2f-79vf-825mCGA-p83q-6j2m-vgg3CGA-pg27-8fq5-746xCGA-pv2m-xcx3-8fx4CGA-q54v-6493-6wmcCGA-qr85-35cm-h77wCGA-r9wg-47cp-pvmwCGA-rh5f-6r28-6q8rCGA-rm9j-6fh6-87ggCGA-v629-h8hc-wmqjCGA-vfv5-w5m3-jjq3CGA-vw46-pfcg-4jjhCGA-w6c4-56hx-hcf3CGA-wf6f-vjm5-rp99CGA-wmwm-r7gv-q5m6CGA-wrq9-7jq8-pcf7CGA-wxhp-qvx5-v3r4CGA-wxxp-67w6-2f77CGA-x779-99qh-m9mgCGA-xm65-7p45-9mx9CGA-xq9w-w9r4-wcqcCGA-xww2-5478-779q
Published 08-07-2026Last modified 08-07-2026
Vulnerability summary
CVE-2026-59895 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in hono. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.4% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 21-09-2026
21-09-202621-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Chainguard32 products
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
Wolfi2 products
- langfuse-3-compat< 3.225.7-r6
- langfuse-3-worker< 3.224.1-r0
Hono1 product
- hono≥ 4.0.0, < 4.12.27
Honojs1 product
- hono≥ 4.0.0, < 4.12.27
Npm1 product
- hono≥ 4.0.0, < 4.12.27
5 vendors · 37 products
References
6 links- github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59X Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/honojs/honoPACKAGE