The flaw resides in the toSSG function of the Hono web framework, where a path traversal bug permits specially crafted dynamic route parameters to escape the intended output directory during static site generation. This allows an attacker to write files anywhere on the build machine, potentially overwriting configuration files or injecting malicious content into the generated site.

Any installation of Hono older than version 4.12.12 is affected, regardless of the JavaScript runtime used. The defect is present in all builds that invoke the toSSG function with user-controllable ssgParams until the patch is applied.

The vulnerability carries a moderate severity score of 5.9. Exploitation requires the attacker to influence the static site generation parameters, which is typically possible only during site build or deployment. No public exploits are recorded and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation would allow a compromise of the build environment’s file system but does not provide remote code execution beyond file write capabilities.