CVE-2026-126359
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.
| CWE | CWE-79 |
| Vendor | honojs |
| Product | hono |
| Published | Nov 12, 2026 |
Get instant alerts for honojs hono
Be the first to know when new low vulnerabilities affecting honojs hono are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N