Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-xf4j-xp2r-rqqx | Hono: Path traversal in toSSG() allows writing files outside the output directory |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 08 Apr 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12. | |
| Title | Hono has a path traversal in toSSG() allows writing files outside the output directory | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-08T14:42:25.357Z
Reserved: 2026-04-07T00:23:30.594Z
Link: CVE-2026-39408
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-08T15:16:14.823
Modified: 2026-04-08T15:16:14.823
Link: CVE-2026-39408
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses