---
id: "GHSA-3gg2-335m-rxc6"
page: "https://infrastack.ai/live/GHSA-3gg2-335m-rxc6"
kind: "vulnerability"
aliases: ["GHSA-3gg2-335m-rxc6"]
title: "`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection"
severity: "low"
cvss: 3.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hono", "fixed": ["4.13.16"], "affected": ">= 3.12.0, <= 4.13.15", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-79", "hono", "jsx", "npm", "package", "server-side-rendering"]
not_affected_if: ["hono-above-4.13.15", "hono-below-3.12.0", "no-less-than-before-interpolation", "no-untrusted-css-interpolation"]
published_at: "2026-11-01T02:29:01+00:00"
first_seen_at: "2026-11-09T22:53:17+00:00"
updated_at: "2026-11-09T22:57:21+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6", "first_seen_at": "2026-11-09T22:53:17+00:00"}]
exploit_sources: []
---

# `css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Link for people: https://infrastack.ai/live/GHSA-3gg2-335m-rxc6 (this .md is for agents)

The css helper in hono/css fails to escape a slash after a less-than sign when the < comes from the template or a previous value, so a value starting with /style> closes the style element early. An attacker who controls such a value can inject HTML, including script, into a page rendered on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:hono affected >= 3.12.0, <= 4.13.15 fixed 4.13.16

## How to check

- Check the installed hono version with `npm ls hono`
- Search the code for `css` template literals from `hono/css` that interpolate user-controlled values directly after a `<`, including two adjacent interpolations like `${prefix}${name}`

## Fix

- hono: upgrade to `4.13.16`

## Timeline

- 2026-11-09T22:53:17+00:00 ghsa-repo https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6

## From the sources

### Summary

The `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `<style>` element. The check only looks inside each value. When the text before a value ends with `<`, whether that is the template itself or an earlier interpolated value, and the next value starts with `/`, the `/` is not escaped and the combined output contains an unescaped closing tag.

### Details

Interpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes `</` therefore cannot see a `<` that belongs to the template. A template such as a `content` declaration that opens with a literal `<` and interpolates a string right after it produces a raw `</style>` when that string starts with `/style>`. During server-side rendering the `<Style />` element is closed early and the rest of the value is interpreted as HTML.

This issue arises only when `<` is the last character before an interpolation in a `css` template, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.

### Impact

A client that controls such a value can inject HTML, including script, into the page rendered on the server.

This may lead to:

- Execution of attacker-controlled script in the browser of a user who views the page
- Exposure of information available to that page

This issue affects applications that interpolate untrusted strings into a `css` template immediately after a `<`, including two adjacent interpolations such as `${prefix}${name}` where both are untrusted. Other uses of the `css` helper are not affected.

### Workarounds

Do not interpolate untrusted values into `css` templates, or make sure the text before an interpolated value does not end with `<`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_