Prior to version 4.12.18, the Hono framework’s JSX renderer escapes style attribute object values for HTML but does not perform sanitization for CSS. Untrusted input that appears in a style object value or property name can therefore inject arbitrary CSS declarations into the rendered style attribute. This flaw is limited to CSS; it does not provide a path to JavaScript execution or HTML attribute breakout, yet it can modify the presentation of the page and potentially lead to phishing or UI redirection attacks. The problem is rooted in improper encoding of user-supplied data (CWE‑116) and improper filtering of style inputs (CWE‑74).

The vulnerability affects Hono, a web framework developed by honojs, in all releases prior to 4.12.18. The affected code paths involve the JSX renderer that accepts style objects from user input.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively exploited in the wild. Attackers would need to supply crafted style object values or property names in requests that are rendered by the framework. Given the limited impact to CSS, the risk to confidentiality, integrity, and availability is moderate; however, the ability to alter page appearance can be used for social engineering.