CVE-2026-56761 — MEDIUM (4.3)

Q: How severe is CVE-2026-56761?

CVE-2026-56761 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-56761?

Check the references section above for vendor advisories and patch information. Affected products include: Hono Hono.

Vulnerability Description

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Hono	Hono	< 4.12.14

Related Weaknesses (CWE)

CWE-79

References

https://github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375Vendor Advisory
https://www.vulncheck.com/advisories/hono-html-injection-via-improper-jsx-attribThird Party Advisory

FAQ

What is CVE-2026-56761?

CVE-2026-56761 is a vulnerability with a CVSS score of 4.3 (MEDIUM). hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specia...

How severe is CVE-2026-56761?

CVE-2026-56761 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-56761?

Check the references section above for vendor advisories and patch information. Affected products include: Hono Hono.