CVE-2026-126359

The Hono web framework is vulnerable to HTML injection in versions 3.12.0 through 4.13.15 due to an issue in the css helper . The helper improperly escapes interpolated values by processing them separately; if a template ends with < and an attacker-controlled value begins with /, the combined ...