The Lab · 2026-04-08 04:27:06 · GitHub Issues
A critical path traversal vulnerability has been disclosed in the popular Hono web framework, exposing systems to potential file system compromise during static site generation. The flaw, tracked as CVE-2026-39408, resides in the `toSSG()` function. It allows specially crafted dynamic route parameters to manipulate gen...
The Lab · 2026-04-08 10:26:59 · GitHub Issues
A critical security vulnerability has been disclosed in the popular Hono.js web framework, exposing a path traversal flaw during static site generation. The issue, tracked as CVE-2026-39408, resides within the `toSSG()` function and could allow files to be written outside the configured output directory when using dyna...
The Lab · 2026-04-08 10:27:03 · GitHub Issues
A critical path traversal vulnerability in the Hono.js web framework's static site generation function, `toSSG()`, has been disclosed. The flaw, tracked as CVE-2026-39408, allows attackers to write files outside the configured output directory. This occurs when using dynamic route parameters via `ssgParams`; specially ...