{"id":"CVE-2026-126359","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126359","summary":"Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection","details":"### Summary\n\nThe `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `<style>` element. The check only looks inside each value. When the text before a value ends with `<`, whether that is the template itself or an earlier interpolated value, and the next value starts with `/`, the `/` is not escaped and the combined output contains an unescaped closing tag.\n\n### Details\n\nInterpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes `</` therefore cannot see a `<` that belongs to the template. A template such as a `content` declaration that opens with a literal `<` and interpolates a string right after it produces a raw `</style>` when that string starts with `/style>`. During server-side rendering the `<Style />` element is closed early and the rest of the value is interpreted as HTML.\n\nThis issue arises only when `<` is the last character before an interpolation in a `css` template, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.\n\n### Impact\n\nA client that controls such a value can inject HTML, including script, into the page rendered on the server.\n\nThis may lead to:\n\n- Execution of attacker-controlled script in the browser of a user who views the page\n- Exposure of information available to that page\n\nThis issue affects applications that interpolate untrusted strings into a `css` template immediately after a `<`, including two adjacent interpolations such as `${prefix}${name}` where both are untrusted. Other uses of the `css` helper are not affected.\n\n### Workarounds\n\nDo not interpolate untrusted values into `css` templates, or make sure the text before an interpolated value does not end with `<`.","published":"2026-11-12T23:22:36Z","modified":"2026-11-12T23:30:03.858972167Z","cvss":{"score":3.4,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"hono","fixedVersion":"4.13.16"}],"fix":{"url":"https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513","label":"honojs/hono@15bbd96"},"references":[{"type":"WEB","url":"https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6"},{"type":"WEB","url":"https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513"},{"type":"PACKAGE","url":"https://github.com/honojs/hono"},{"type":"WEB","url":"https://github.com/honojs/hono/releases/tag/v4.13.16"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-12T23:30:03.858972167Z"}}