GHSA-XF4J-XP2R-RQQX
Vulnerability from github – Published: 2026-04-08 00:16 – Updated: 2026-04-08 15:34Summary
A path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory.
Details
The static site generation process creates output files based on route paths derived from application routes and parameters. When ssgParams is used to provide values for dynamic routes, those values are used to construct output file paths. If these values contain traversal sequences (e.g. ..), the resulting output path may resolve outside the configured output directory. As a result, files may be written to unintended locations instead of being confined within the specified output directory.
For example:
import { Hono } from 'hono'
import { toSSG, ssgParams } from 'hono/ssg'
const app = new Hono()
app.get('/:id', ssgParams([{ id: '../pwned' }]), (c) => {
return c.text('pwned')
})
toSSG(app, fs, { dir: './static' })
In this case, the generated output path may resolve outside ./static, resulting in a file being written outside the intended output directory.
Impact
An attacker who can influence values passed to ssgParams during the build process may be able to write files outside the intended output directory.
Depending on the build and deployment environment, this may:
- overwrite unintended files
- affect generated artifacts
- impact deployment outputs or downstream tooling
This issue is limited to build-time static site generation and does not affect request-time routing.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.12.11"
},
"package": {
"ecosystem": "npm",
"name": "hono"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.12.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39408"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-08T00:16:51Z",
"nvd_published_at": "2026-04-08T15:16:14Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nA path traversal issue in `toSSG()` allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via `ssgParams`, specially crafted values can cause generated file paths to escape the intended output directory.\n\n## Details\n\nThe static site generation process creates output files based on route paths derived from application routes and parameters. When `ssgParams` is used to provide values for dynamic routes, those values are used to construct output file paths. If these values contain traversal sequences (e.g. `..`), the resulting output path may resolve outside the configured output directory. As a result, files may be written to unintended locations instead of being confined within the specified output directory.\n\nFor example:\n \n```ts\nimport { Hono } from \u0027hono\u0027\nimport { toSSG, ssgParams } from \u0027hono/ssg\u0027\n\nconst app = new Hono()\n\napp.get(\u0027/:id\u0027, ssgParams([{ id: \u0027../pwned\u0027 }]), (c) =\u003e {\n return c.text(\u0027pwned\u0027)\n})\n\ntoSSG(app, fs, { dir: \u0027./static\u0027 })\n```\n\nIn this case, the generated output path may resolve outside `./static`, resulting in a file being written outside the intended output directory.\n\n## Impact\n\nAn attacker who can influence values passed to `ssgParams` during the build process may be able to write files outside the intended output directory.\n\nDepending on the build and deployment environment, this may:\n\n* overwrite unintended files\n* affect generated artifacts\n* impact deployment outputs or downstream tooling\n\nThis issue is limited to build-time static site generation and does not affect request-time routing.",
"id": "GHSA-xf4j-xp2r-rqqx",
"modified": "2026-04-08T15:34:35Z",
"published": "2026-04-08T00:16:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-xf4j-xp2r-rqqx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39408"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/commit/b470278920fffcfd6d76002755d6db53db827679"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/hono"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/releases/tag/v4.12.12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Hono: Path traversal in toSSG() allows writing files outside the output directory"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.