CVE-2026-59895 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, wazuh-dashboard, librechat, commercial-gitlab-rails-ee, langfuse, commercial-gitlab-rails-ee-fips, langfuse-fips...

CVE-2026-59895 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class...