Hono JSX Renderer CSS Injection Vulnerability

A vulnerability in the Hono web application framework, prior to version 4.12.18, allows for the injection of arbitrary CSS declarations into rendered style attributes. This issue arises because the JSX renderer escapes style object values for HTML but not for CSS. As a result, untrusted input in a style object value or property name can exploit this discrepancy. The vulnerability is limited to CSS injection and does not permit JavaScript execution or HTML attribute breakout.

Impact

Exploitation of this vulnerability could lead to unauthorized CSS injection, allowing for visual manipulation of the page, such as creating full-viewport overlays for phishing. It could also enable outbound requests to attacker-controlled hosts via CSS resource references, or hijack UI elements through changes in layout, positioning, or visibility.

Remediation

Users are advised to update to Hono version 4.12.18 or later.