hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of
    Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a
    Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from
    hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so
    an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute
    script under the application's origin. (CVE-2026-93981)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of     Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a     Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from     hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so     an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute     script under the application's origin. (CVE-2026-93981)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471607	Echo: hono: security update to 4.13.7	Tenable Cloud Security	Echo Local Security Checks	Local	low
471607	Echo: hono: security update to 4.13.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
465528	Chainguard: librechat: security update to 0.8.7-r16	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
465528	Chainguard: librechat: security update to 0.8.7-r16	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
349164	Linux Distros Unpatched Vulnerability : CVE-2026-93981	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-93981

low

Tenable Plugins

low

low

low

low

low