GHSA-w62v-xxxg-mg59
MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Blast Radius
Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.
hononpmDescription
Summary
cx() in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of the class attribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).
Details
Because the composed value is treated as pre-escaped, the HTML attribute escaping normally applied to interpolated values is skipped, and characters such as " pass through unescaped — allowing a value to terminate the attribute and add further attributes or elements. This arises when an application passes untrusted, user-controlled input as a class name to cx(), for example when merging a base class with an externally provided className.
Impact
During server-side rendering, an attacker who controls a value passed to cx() can inject arbitrary HTML into the page, resulting in stored or reflected XSS in the victim's browser.
This may lead to:
- Execution of attacker-controlled script in the victim's browser session.
- Session hijacking, credential theft, or actions performed on behalf of the victim.
Applications are affected only if they render JSX server-side and pass untrusted input as a class name to cx().
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | hono | ≥ 4.0.0&&< 4.12.27 | 4.12.27 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hono. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update hono to 4.12.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w62v-xxxg-mg59 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-w62v-xxxg-mg59 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-w62v-xxxg-mg59. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-w62v-xxxg-mg59 in your dependencies?
O3 detects GHSA-w62v-xxxg-mg59 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.