The honojs hono framework versions before 4.12.16 improperly handle JSX element tag names by allowing unvalidated, untrusted input to be used directly in HTML output during server-side rendering. When tag names are supplied programmatically via jsx() or createElement() APIs, maliciously crafted values can escape the intended element context, resulting in injection of unintended HTML content. This is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity. The issue is resolved in hono version 4.12.16.

Exploitation of this vulnerability can lead to injection of unintended HTML content in server-side rendered pages, potentially affecting the integrity and presentation of the web application. The CVSS vector indicates that the attack requires network access, high attack complexity, no privileges, and user interaction, with a scope change and low impact on confidentiality and integrity, and no impact on availability. There are no known exploits in the wild at this time.

Upgrade honojs hono to version 4.12.16 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 4.12.16, applying this official update is the recommended remediation. Patch status is not explicitly stated beyond this version update, so check the vendor advisory for any additional guidance.