GHSA-3GG2-335M-RXC6 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Summary The css helper in hono/css escapes a / that follows element. The check only looks inside each value. When the text before a value ends with when that string starts with /style. During server-side rendering the element is closed early and the rest of the value is interpreted as HTML. This...