Executive brief
Hono is a web application framework used to build and deploy JavaScript-based websites. A security flaw in its static site generation tool allows an attacker to manipulate file paths, potentially writing files to unauthorized locations on the server during the build process. This could lead to the overwriting of sensitive system files or the corruption of the website's deployment artifacts.
Technical details
A path traversal vulnerability exists in the toSSG() function of the Hono web framework. The root cause is insufficient sanitization of dynamic route parameters provided via ssgParams during the Static Site Generation (SSG) process. An attacker who can influence these parameters can use traversal sequences (e.g., '../') to escape the designated output directory. This allows for arbitrary file writes at build-time, potentially overwriting critical files or affecting downstream deployment tooling. The issue is fixed in version 4.12.12.
Affected products
- honojs Hono >= 4.0.0, < 4.12.12
Timeline
- 2026-04-07: patched: Fixed in version 4.12.12
- 2026-04-08: disclosed: Initial advisory publication