v4.13.7
smicallef/spiderfootv4.13.7Sep 4, 2026by yusukebe
Upgrading?
AI Summary
This release addresses a critical XSS vulnerability in Hono's JSX rendering components where untrusted strings were not properly escaped when used in Suspense, ErrorBoundary, or Context.Provider components.
Key Highlights
- Fixes XSS vulnerability in hono/jsx (GHSA-hxh3-vqpv-xpqv)
- Escapes untrusted strings in Suspense, ErrorBoundary, Context.Provider
- Fixes server rendering functions (renderToString/renderToReadableStream)
Full Release Notes
## Security fixes This release includes a fix for the following security issue: ### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv --- Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.
Related Repositories
public-apis/public-apis★ 491,220
A collective list of free APIs
NousResearch/hermes-agent★ 256,091
The agent that grows with you
yt-dlp/yt-dlp★ 200,268
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,564
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.