https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 14:30:01 +0000 https://vulnerability.circl.lu/vuln/ghsa-qp7p-654g-cw7p <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>The JSX renderer escapes `style` attribute object values for HTML but not for CSS. Untrusted input in a `style` object value or property name can therefore inject additional CSS declarations into the rendered `style` attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout.</p> <p>### Details</p> <p>`style` object values are serialized into a CSS declaration list and escaped for HTML attribute context only. Characters that act as CSS declaration boundaries — such as `;`, comment markers, quoted strings, and block delimiters — are valid in HTML attribute content and can extend a value beyond its assigned property.</p> <p>This issue arises when untrusted input is interpolated into a JSX `style` object and rendered server-side.</p> <p>### Impact</p> <p>An attacker who can control the value or property name of a `style` object may inject arbitrary CSS declarations. This may lead to:</p> <p>- Visual manipulation of the page, including full-viewport overlays usable for phishing - Outbound requests to attacker-controlled hosts via CSS resource references such as `url(...)` - Hijacking of UI affordances through layout, positioning, or visibility changes</p> <p>This issue affects applications that render JSX on the server with `style` object values or property names derived from untrusted input.</p> <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>The JSX renderer escapes `style` attribute object values for HTML but not for CSS. Untrusted input in a `style` object value or property name can therefore inject additional CSS declarations into the rendered `style` attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout.</p> <p>### Details</p> <p>`style` object values are serialized into a CSS declaration list and escaped for HTML attribute context only. Characters that act as CSS declaration boundaries — such as `;`, comment markers, quoted strings, and block delimiters — are valid in HTML attribute content and can extend a value beyond its assigned property.</p> <p>This issue arises when untrusted input is interpolated into a JSX `style` object and rendered server-side.</p> <p>### Impact</p> <p>An attacker who can control the value or property name of a `style` object may inject arbitrary CSS declarations. This may lead to:</p> <p>- Visual manipulation of the page, including full-viewport overlays usable for phishing - Outbound requests to attacker-controlled hosts via CSS resource references such as `url(...)` - Hijacking of UI affordances through layout, positioning, or visibility changes</p> <p>This issue affects applications that render JSX on the server with `style` object values or property names derived from untrusted input.</p> https://vulnerability.circl.lu/vuln/ghsa-qp7p-654g-cw7p