CVE-2026-93981

[CVE catalog]

Severity

Medium · CVSS 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Published

Sep 19, 2026, 11:53:34 AM UTC

Updated

Sep 19, 2026, 12:16:41 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.23% · Oct 25, 2026

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting (XSS). This allows the attacker to inject malicious code into web pages viewed by other users, potentially compromising user sessions or defacing the website. hono: hono/jsx: Cross-Site Scripting via Unescaped Strings This vulnerability is evaluated as having Moderate severity because successful exploitation requires specific application rendering contexts where unescaped user input is directly evaluated by server-side template boundaries. Within Red Hat supported products, the affected package is included as an embedded dependency within containerized services and developer tooling. Exploitation requires an attacker to induce the application to render untrusted input through these specific server-side rendering constructs, restricting potential exposure to targeted application flows. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.