Ggmolly

**Name of the Vulnerable Software and Affected Versions** hono versions prior to 4.13.7 **Description** The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is present, as the single child of a Context.Provider, or as the root value passed to the `renderToString()` or `renderToReadableStream()` functions from hono/jsx/dom/server. In these cases, the input is stringified and treated as already-escaped markup, allowing an attacker to inject arbitrary HTML and execute scripts under the application's origin during server-side rendering. **Recommendations** Update hono to version 4.13.7 or later.