Hono versions prior to 4.12.18 have a vulnerability in their JSX server-side rendering where untrusted input in style object values or property names can inject additional CSS declarations. This CSS injection does not allow JavaScript execution or HTML attribute breakout but can manipulate page visuals, cause phishing overlays, or trigger outbound requests via CSS resource references. The vulnerability is fixed in version 4.12.18.