cx() in the Hono framework concatenates class names from string inputs and marks the output as already escaped without performing HTML escaping. When untrusted className data is supplied during server‑side rendering of JSX, a malicious user can break out of the class attribute and inject arbitrary markup, enabling client‑side code injection delivered by the server.

The vulnerability affects installations of the Hono web framework produced by honojs. Versions from 4.0.0 up to but not including 4.12.27 are vulnerable. The issue was fixed in release 4.12.27.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. An attacker can exploit the vulnerability by providing untrusted className data that reaches the cx() function during server‑side rendering of JSX, enabling arbitrary markup injection. The vulnerability description does not mention authentication or privilege requirements, so any user who can influence className values in rendered output may potentially exploit it.