Executive brief
Hono's static site generation feature (toSSG) contains a path traversal vulnerability that allows files to be written outside the intended output directory. When generating static sites from route parameters derived from untrusted sources (such as CMS slugs or user submissions), an attacker can supply values with consecutive parent-directory traversal sequences that bypass the incomplete path validation check. This could result in build artifacts being created or overwritten in unintended locations on the build server.
Technical details
This is an incomplete fix for a prior path traversal vulnerability (CVE-2026-39408). The toSSG() function builds file output paths from route paths and ssgParams values, then validates that the result stays within the configured output directory. The validation routine normalizes paths but fails to fully collapse consecutive parent-directory segments (..). An attacker can craft ssgParams values containing enough consecutive .. sequences that the normalized check passes, but the filesystem still resolves the path outside the restricted directory. The vulnerability exists because the initial fix only addressed single parent-directory segments, leaving longer traversal runs unhandled. Additionally, the check treated output directories differing only in rooting format as equivalent. This is a build-time issue only; request-time routing is not affected. Exploitation requires that ssgParams values derive from untrusted sources like CMS or user input. The vulnerability was patched in version 4.13.5.
Affected products
- Hono hono < 4.13.5
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-09-01: patched: Fix released in version 4.13.5
- 2026-08-26: other: Published to GitHub via security advisory
- 2026-09-01: other: Published to National Vulnerability Database (NVD)