CVE-2026-44458 — Hono: CSS Declaration Injection via Style Object Values in JSX SSR

CVE-2026-44458

Hono: CSS Declaration Injection via Style Object Values in JSX SSR PUBLISHED

Description (CNA)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.

Affected (CNA)

Vendor / product	Versions
honojs / hono	affected < 4.12.18

CWE

CWE-74, CWE-116

References

https://github.com/honojs/hono/security/advisories/GHSA-qp7p-654g-cw7p

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.