CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

CVE-2026-93981

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

PT-2026-95818

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7 Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is presen...

CVE-2026-93981: Improper Neutralization of Input During Web Page Generation

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

PT-2026-105486

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sep parameter in the table rendering process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML through the unsanitized separator value. Details...

CVE-2025-53837

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

org.xwiki.rendering:xwiki-rendering-macro-html (>=5.2-milestone-1, <=14.10.1), org.xwiki.rendering:xwiki-rendering-standalone (>=5.2-milestone-1, <=14.10.1) +19 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (>=5.0-milestone-1, <=14.10.1)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version =5.0-milestone-1, =5.2-milestone-1, =5.2-milestone-1, =6.4-milestone-3, =5.2-milestone-1, =5.4.5, =14.6-rc-1, =5.2-milestone-1, =6.4-milestone-3, =14.6-rc-1, =5.2-milestone-1, =5.2-rc-1, =5.2-rc-1, =14.6-rc-1, =5.2-milestone-1, =5.0-milestone...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

EUVD-2025-210935

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

org.xwiki.rendering:xwiki-rendering-macro-html (6.4.4), org.xwiki.rendering:xwiki-rendering-standalone (6.4.4) +11 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (6.4.4)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-xml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 6.4.4 -...

org.xwiki.rendering:xwiki-rendering-macro-html (7.1), org.xwiki.rendering:xwiki-rendering-standalone (7.1) +11 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (7.1)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version 7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-xml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 7.1 -...

org.xwiki.rendering:xwiki-rendering-macro-html (9.6), org.xwiki.rendering:xwiki-rendering-standalone (9.6) +8 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (9.6)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version 9.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-xml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 9.6 -...

org.xwiki.rendering:xwiki-rendering-macro-html (13.10.3), org.xwiki.rendering:xwiki-rendering-standalone (13.10.3) +8 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (13.10.3)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version 13.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-xml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 13.10.3 -...