CVE-2026-126359 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

The Hono web framework is vulnerable to HTML injection in versions 3.12.0 through 4.13.15 due to an issue in the css helper . The helper improperly escapes interpolated values by processing them separately; if a template ends with < and an attacker-controlled value begins with /, the combined ...