A flaw in Hono’s server‑side rendering of JSX allows attackers to craft malformed attribute names that contain characters such as quotes or angle brackets. By sending a specially constructed request, an attacker can break out of a legitimate HTML tag boundary and insert arbitrary attributes or even new elements, resulting in unintended HTML content or JavaScript execution within the rendered page. The weakness is a classic cross‑site scripting issue (CWE‑79).

The vulnerability affects the Hono framework before version 4.12.14. Any deployment of Hono 4.12.13 or earlier, regardless of the underlying Node.js version, is susceptible to HTML injection via its JSX SSR feature.

The CVSS score of 5.3 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via crafted HTTP requests to endpoints that use Hono’s JSX SSR. Exploitation requires an attacker to control or influence the attribute key in a JSX template rendered on the server.