Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSR
Medium 4.3
In plain English
A medium-severity injection in hono from honojs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | hono | 4.12.18 | GHSA-qp7p-654g-cw7p |
Affected products (as reported)
Weakness: CWE-74, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/honojs/hono/security/advisories/GHSA-qp7p-654g-cw7p x_refsource_CONFIRM