Is CVE-2026-44455 actively exploited?

No active exploitation of CVE-2026-44455 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44455 be exploited remotely?

Yes. CVE-2026-44455 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44455?

CVE-2026-44455 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-44455

MEDIUM

CVE-2026-44455

CWE-74Published: May 13, 2026· Updated: May 13, 2026

6.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.8th

Official Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.

NVD Source

Technical Analysis

CVE-2026-44455 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.