The vulnerability in Hono allows unvalidated JSX element tag names to be injected directly into the server‑side rendered HTML. When an attacker supplies crafted values to the jsx() or createElement() APIs, the generated markup may escape the intended element context, resulting in arbitrary HTML injection. This flaw is a typical input validation issue (CWE‑74) and could be exploited to perform cross‑site scripting or other injection attacks against users of the web application.

The affected product is the Hono web application framework (honojs:hono). All releases before version 4.12.16 are vulnerable; the issue was addressed in the 4.12.16 release and later.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score is not available, suggesting no current exploit data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is server‑side rendering where untrusted input is used to create JSX tag names; no special privileges or network exploits are required beyond providing input to the application.