Cross-site scripting in hono - CVE-2026-24771
Published: July 24, 2026
Vulnerability identifier: #VU139317
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-24771
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the ErrorBoundary component when rendering untrusted user-controlled strings as raw HTML. A remote attacker can supply crafted input that is reflected in rendered content to execute arbitrary script in the victim's browser.
User interaction is required, and the issue is only exploitable when an application renders untrusted user input within ErrorBoundary.
Affected software
hono
How to mitigate CVE-2026-24771
Install security update from vendor's website.
hono - update to 4.11.7