CVE-2026-126359 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Apps using Hono's css helper with untrusted strings after a closing tag can render attacker-controlled HTML or script to viewers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-126359?
CVE-2026-126359 is a low-severity cross-site scripting vulnerability in honojs hono, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.
Weakness: CWE-79
Which versions are affected by CVE-2026-126359?
1 open source package ship an affected version, including hono.
An affected version is only exploitable if your software calls css. Many projects that include it are not exposed.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | From 3.12.0 | 4.13.16 |
How do I fix CVE-2026-126359?
Upgrade hono to 4.13.16 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-126359 being exploited?
There is no known exploitation of CVE-2026-126359 in the wild and no public exploit code.
Sources
Also known as GHSA-3gg2-335m-rxc6.