hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

GHSA-HXH3-VQPV-XPQV hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

Malicious code in egstore-suspense (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2289 Malicious code in egstore-suspense (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview egstore-suspense is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

THN Review : Ghost in the Wires - Kevin Mitnick

THN Review : Ghost in the Wires - Kevin Mitnick First of all Thanks to Mr. Kevin Mitnick for sending Review Copy of his latest book & Auto-Biography "Ghost in the Wires - My Adventures As The World's Most Wanted Hacker". I take about a week to read this amazing book and Finally The Hacker News...