Description

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T21:18:47.450Z",
  "pubdate": "2026-09-01T21:18:47.450Z",
  "executiveSummary": "Hono is vulnerable to an improper input validation flaw within its static site generation (SSG) functionality, identified as a path traversal vulnerability. This issue stems from incomplete sanitization of route parameters and ssgParams, allowing attackers to escape the designated output directory during the build process.\nThe vulnerability affects Hono versions 4.12.12 through 4.13.4. If an application utilizes untrusted input—such as slugs sourced from a CMS, external API, or user submissions—to drive static site generation, a malicious actor could force the framework to write or overwrite files outside the intended build directory.\nThis vulnerability is strictly limited to the build-time environment; request-time routing remains unaffected. The primary risk involves unauthorized file system manipulation, which could lead to code injection, build artifact corruption, or the alteration of deployment outputs. Successful exploitation requires the application to incorporate unvalidated external data into the ssgParams configuration. Developers should prioritize updating to version 4.13.5 to implement the corrected path normalization logic.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient path normalization routine used by the toSSG() function. While Hono attempts to verify that generated file paths remain within the configured output directory, the normalization mechanism fails to correctly handle and collapse sequences of consecutive parent-directory segments (e.g., ../../../).\nIn the affected versions, the validation logic employs the same flawed normalization routine that constructs the target path. Consequently, if an attacker provides a maliciously crafted string within ssgParams, the routine treats the path as safe because the normalization fails to detect the exit from the root directory boundary before the file write operation occurs. Furthermore, the validator incorrectly equates different directory root structures, bypassing security checks intended to enforce containment.\nThe attack flow begins when an application pulls dynamic data into the ssgParams during the static generation build phase. A malicious actor provides a specially crafted input (e.g., a path containing '/../') that is processed by toSSG(). Because the path validation relies on the flawed normalization logic, the OS-level file system API interprets the sequence as a directive to move upwards in the directory tree. This allows the process, which runs with the privileges of the build environment, to write files to arbitrary locations accessible by the build user.\nThis vulnerability is localized to the build-time static site generation component. It does not affect standard request-time routing. However, the post-exploitation impact is significant: by overwriting critical files within the build environment, an attacker can influence deployment artifacts, potentially leading to cross-site scripting (XSS) via injected scripts, or even remote code execution (RCE) if configuration files or build scripts are targeted.\nThe vulnerability is present in Hono versions 4.12.12 through 4.13.4. It is an evolution of an incomplete fix for CVE-2026-39408. Exploitation requires no authentication in the traditional sense, as it is an injection vulnerability targeting the CI/CD or build pipeline where the static site is generated using untrusted data sources.\nThe normalization failure ensures that the directory traversal check is bypassed by default, as the logic effectively blinds itself to the recursive nature of the path segments, treating the malicious output path as legitimate within the intended directory scope."
}