PT-2026-39328 · Hono · Hono

Published 2026-05-09 · Updated 2026-05-18 · CVE-2026-44458

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.18

Description The JSX renderer escapes style attribute object values for HTML but not for CSS. When untrusted input is interpolated into a JSX style object and rendered server-side, characters that act as CSS declaration boundaries—such as ;, comment markers, quoted strings, and block delimiters—can be used to inject additional CSS declarations into the rendered style attribute. This allows an attacker to control the value or property name of a style object, potentially leading to visual page manipulation (including full-viewport overlays for phishing), outbound requests to attacker-controlled hosts via CSS resource references like url(...), and hijacking of UI affordances through layout, positioning, or visibility changes. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout.

Recommendations Update to version 4.12.18.

Fix

Special Elements Injection

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-74

CWE-116

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-44458

GHSA-QP7P-654G-CW7P

Affected Products

Hono

References · 170

• https://github.com/honojs/hono/security/advisories/GHSA-qp7p-654g-cw7p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29045 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42038 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750 · Security Note