{"id":"GHSA-3gg2-335m-rxc6","kind":"vulnerability","aliases":["GHSA-3gg2-335m-rxc6"],"related":[],"title":"`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection","description":"### Summary\n\nThe `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `<style>` element. The check only looks inside each value. When the text before a value ends with `<`, whether that is the template itself or an earlier interpolated value, and the next value starts with `/`, the `/` is not escaped and the combined output contains an unescaped closing tag.\n\n### Details\n\nInterpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes `</` therefore cannot see a `<` that belongs to the template. A template such as a `content` declaration that opens with a literal `<` and interpolates a string right after it produces a raw `</style>` when that string starts with `/style>`. During server-side rendering the `<Style />` element is closed early and the rest of the value is interpreted as HTML.\n\nThis issue arises only when `<` is the last character before an interpolation in a `css` template, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.\n\n### Impact\n\nA client that controls such a value can inject HTML, including script, into the page rendered on the server.\n\nThis may lead to:\n\n- Execution of attacker-controlled script in the browser of a user who views the page\n- Exposure of information available to that page\n\nThis issue affects applications that interpolate untrusted strings into a `css` template immediately after a `<`, including two adjacent interpolations such as `${prefix}${name}` where both are untrusted. Other uses of the `css` helper are not affected.\n\n### Workarounds\n\nDo not interpolate untrusted values into `css` templates, or make sure the text before an interpolated value does not end with `<`.","summary":"The css helper in hono/css fails to escape a slash after a less-than sign when the < comes from the template or a previous value, so a value starting with /style> closes the style element early. An attacker who controls such a value can inject HTML, including script, into a page rendered on the server.","severity":"low","cvss":3.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hono","fixed":["4.13.16"],"affected":">= 3.12.0, <= 4.13.15","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","hono","jsx","npm","package","server-side-rendering"],"not_affected_if":["hono-above-4.13.15","hono-below-3.12.0","no-less-than-before-interpolation","no-untrusted-css-interpolation"],"how_to_check":"- Check the installed hono version with `npm ls hono`\n- Search the code for `css` template literals from `hono/css` that interpolate user-controlled values directly after a `<`, including two adjacent interpolations like `${prefix}${name}`","fix":"- hono: upgrade to `4.13.16`","status":"open","published_at":"2026-11-01T02:29:01+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","triaged_at":"2026-11-09T22:57:21+00:00","updated_at":"2026-11-09T22:57:21+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:57:21Z","model":"claude-haiku-5-5","output":{"fix":"- hono: upgrade to `4.13.16`","reach":"internet","title":"Hono: css helper lets a closing style tag be injected into HTML","impact":"medium","summary":"The css helper in hono/css fails to escape a slash after a less-than sign when the < comes from the template or a previous value, so a value starting with /style> closes the style element early. An attacker who controls such a value can inject HTML, including script, into a page rendered on the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["hono","npm","server-side-rendering","jsx"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker injects script into server-rendered pages viewed by users","analyst_note":"","how_to_check":"- Check the installed hono version with `npm ls hono`\n- Search the code for `css` template literals from `hono/css` that interpolate user-controlled values directly after a `<`, including two adjacent interpolations like `${prefix}${name}`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hono-below-3.12.0","hono-above-4.13.15","no-untrusted-css-interpolation","no-less-than-before-interpolation"],"who_is_affected":"Applications that use the css helper from hono/css and interpolate untrusted strings into a css template right after a < character, either written in the template or supplied by an earlier value, and render the result on the server. Other uses of the css helper are not affected according to the advisory.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000792,"input_tokens":5082,"output_tokens":567,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-79':30B '/style':70B,121C '335m':21A,26A '3gg2':20A,25A 'allow':15A 'assembl':9A 'attack':77B 'cannot':113C 'close':7A,71B,114C 'come':57B 'control':79B 'css':1A,40B,97C 'cwe':29B 'earli':75B 'element':74B 'escap':5A,46B,101C 'fail':44B 'follow':104C 'ghsa':19A,24A 'ghsa-3gg2-335m-rxc6':18A,23A 'helper':2A,41B,98C 'hono':28A,31B 'hono/css':43B,100C 'html':16A,85B 'includ':86B 'inject':17A,84B 'insid':105C 'interpol':107C 'jsx':32B 'less':52B 'less-than':51B 'npm':33B 'packag':34B 'page':90B 'part':12A 'previous':63B 'render':38B,91B,126C 'rxc6':22A,27A 'script':87B 'server':36B,94B,124C 'server-sid':123C 'server-side-rend':35B 'side':37B,125C 'sign':54B 'slash':48B 'start':68B,119C 'string':118C 'style':73B 'summari':95C 'tag':8A 'templat':11A,60B 'valu':14A,64B,67B,82B,108C,112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the css helper from hono/css and interpolate untrusted strings into a css template right after a < character, either written in the template or supplied by an earlier value, and render the result on the server. Other uses of the css helper are not affected according to the advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["hono"],"ptokens":["hono"],"labels":["cwe79","hono","jsx","low","npm","package","serversiderendering"],"campaign_type":null,"search_a":"'335m':21A,26A '3gg2':20A,25A 'allow':15A 'assembl':9A 'close':7A 'css':1A 'escap':5A 'ghsa':19A,24A 'ghsa-3gg2-335m-rxc6':18A,23A 'helper':2A 'hono':28A 'html':16A 'inject':17A 'part':12A 'rxc6':22A,27A 'tag':8A 'templat':11A 'valu':14A","search_b":"'-79':30B '/style':70B 'attack':77B 'close':71B 'come':57B 'control':79B 'css':40B 'cwe':29B 'earli':75B 'element':74B 'escap':46B 'fail':44B 'helper':41B 'hono':31B 'hono/css':43B 'html':85B 'includ':86B 'inject':84B 'jsx':32B 'less':52B 'less-than':51B 'npm':33B 'packag':34B 'page':90B 'previous':63B 'render':38B,91B 'script':87B 'server':36B,94B 'server-side-rend':35B 'side':37B 'sign':54B 'slash':48B 'start':68B 'style':73B 'templat':60B 'valu':64B,67B,82B","search_c":"'/style':121C 'cannot':113C 'close':114C 'css':97C 'escap':101C 'follow':104C 'helper':98C 'hono/css':100C 'insid':105C 'interpol':107C 'render':126C 'server':124C 'server-sid':123C 'side':125C 'start':119C 'string':118C 'summari':95C 'valu':108C,112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-01T02:29:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-3gg2-335m-rxc6","url":"https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6","severity":"low","published_at":"2026-11-01T02:29:01+00:00","modified_at":"2026-11-01T02:33:31+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","fetched_at":"2026-11-09T22:53:17+00:00","note":null}],"documents":[{"id":110467,"url":"https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}