Improper Neutralization of Special Elements in Output Used by a Downstream Component in hono - CVE-2026-44458
Published: July 24, 2026
Vulnerability identifier: #VU139283
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44458
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary CSS declarations.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the JSX server-side renderer style attribute serialization when rendering untrusted input in a JSX style object. A remote attacker can supply a crafted style object value or property name to inject arbitrary CSS declarations.
User interaction is required to load the rendered page. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout.
Affected software
hono
How to mitigate CVE-2026-44458
Install security update from vendor's website.
hono - update to 4.12.18