Hono JSX renderer CVE-2026-44458

Exploitation requires: (1) server-side JSX rendering of Hono components (SSR mode, not static export or client-only rendering); (2) untrusted user input (from request query parameters, body, database, or other external source) flowing directly into a JSX style object value or property name without sanitization; (3) victim browser rendering and viewing the malicious page (UI interaction required per CVSS). Non-default configuration is NOT required - applications simply using SSR with dynamic styling are at risk. Exploitation is blocked if: style values are hard-coded, input is sanitized before style assignment, or CSP headers are deployed to restrict resource fetching, though the latter does not prevent visual manipulation.

CVSS 4.3 with AV:N/AC:L/PR:N/UI:R indicates network-accessible, low-complexity exploitation requiring user interaction (UI:R suggests victim must view the rendered page). EPSS and KEV status not provided in input data. The vulnerability requires two confluence factors: (1) server-side JSX rendering enabled and (2) untrusted input flowing into style object keys or values. While CVSS is low-to-moderate and scope is unchanged (S:U), real-world impact is non-negligible for applications using SSR with dynamic styling - phishing overlays and request exfiltration via CSS url() are practical attacks. However, lack of JavaScript execution and HTML attribute breakout significantly limits severity compared to XSS. Attack surface is specific to SSR patterns, not affecting client-only Hono deployments. No exploit complexity noted; a simple semicolon-separated CSS injection suffices. Risk is HIGH for affected applications, MODERATE overall population due to targeted deployment requirement.

An attacker submits a user profile with a custom theme color field containing the payload red; position: fixed; top: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.8); z-index: 9999; cursor: pointer. When a server renders the victim's profile page with <div style={{ color: userTheme }}>, the injected CSS creates a full-viewport overlay. The attacker then uses the overlay as a phishing layer, displaying a fake login prompt that captures credentials when clicked.