Hono · Hono · CVE-2026-59895
**Name of the Vulnerable Software and Affected Versions**
Hono versions 4.0.0 through 4.12.26
**Description**
The `cx()` function in `hono/css` composes class names from plain strings but marks the result as already escaped without performing HTML-escaping on the input. This allows untrusted `className` values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup.
**Recommendations**
Update to version 4.12.27.