Threats tagged 'ghsa-3gg2-335m-rxc6'

The hono css helper has a vulnerability where it fails to properly escape a closing tag split between the template and an interpolated value, allowing an attacker to inject HTML including scripts during server-side rendering. This occurs when a '<' character directly precedes an interpolated value starting with '/', resulting in an unescaped closing tag that prematurely closes the <style> element. The issue affects versions from 3.12.0 up to but not including 4.13.16. A fix is available in version 4.13.16. The vulnerability has a low CVSS score and requires user interaction with high attack complexity.