Cross-Site Scripting Vulnerability in Hono Web Framework from HonoJS
CVE-2026-24771

4.7MEDIUM

Key Information:

Vendor

Honojs

Status
Hono
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24771?

The Hono web application framework, widely utilized for supporting different JavaScript runtimes, has a security flaw in the ErrorBoundary component that enables Cross-Site Scripting (XSS) attacks. Before the release of version 4.11.7, this vulnerability could allow adversaries to inject malicious scripts through untrusted user-controlled input, which may be rendered as raw HTML in affected applications. This issue poses serious security risks as it can lead to arbitrary script execution within the user's browser, compromising the integrity of the application and potentially exposing sensitive user information.

Affected Version(s)

hono < 4.11.7

References

https://github.com/honojs/hono/security/advisories/GHSA-9...
x_refsource_CONFIRM
https://github.com/honojs/hono/commit/2cf60046d730df9fd0a...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.