Executive brief
Hono is a web application framework used to build and run JavaScript-based websites. A vulnerability in its page rendering system allows attackers to inject malicious CSS code into a website if the site displays user-provided content within style settings. This could be used to visually deface a page, create fake login overlays for phishing, or track users, though it does not allow for full account takeover or direct data theft.
Technical details
A CSS injection vulnerability exists in Hono's JSX renderer prior to version 4.12.18. While the renderer escapes style attribute object values for HTML context, it fails to escape them for CSS context. An attacker can use characters like semicolons, comment markers, or block delimiters within a style object value or property name to inject additional CSS declarations. This can lead to visual manipulation, UI hijacking, or outbound requests via CSS 'url()' functions. The vulnerability is limited to CSS and does not permit JavaScript execution (XSS) or HTML attribute breakout. The issue is resolved in version 4.12.18.
Affected products
- Hono Hono < 4.12.18
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fix released in version 4.12.18