{"items":[{"id":"NVI-00013778","kind":"vulnerability","title":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gqvv-2mrq-wpjv","CVE-2026-84365"],"plain_summary":"GitHub lists this reviewed advisory for hono. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-018eba12dc393ae9321c5c08750070bd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T21:23:51.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-018eba12dc393ae9321c5c08750070bd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-018eba12dc393ae9321c5c08750070bd","url":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gqvv-2mrq-wpjv","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-018eba12dc393ae9321c5c08750070bd"],"technology":"hono","known_exclusions":[],"conditions_summary":"### Summary\n\nThe fix released for CVE-2026-39408 does not cover every traversal sequence. `toSSG()` can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.\n\n### Details\n\nStatic site generation builds each output path from the route path and the values supplied through `ssgParams`, then verifies that the result stays inside the output directory. That check normalizes the path with the same routine that built it, and the routine did not fully collapse runs of consecutive parent-directory segments. A value carrying enough of them produces a path the check accepts, but the filesystem resolves outside the output directory.\n\nThe earlier fix handled a single parent-directory segment, so it blocks the sequence reported at the time while leaving longer runs unhandled. The check also treated output directories that differ only in how they are rooted as equivalent.\n\nThis arises when an application generates a static site from route parameter values it does not fully control — slugs coming from a CMS, an API, or user submissions.\n\n### Impact\n\nA value reaching `ssgParams` from an untrusted source can cause build output","public_affected_ranges":["< 4.13.5"]}],"null_published_at":"2026-11-02T10:00:37.147Z","source_updated_at":"2026-09-08T21:23:51.000Z","source_disclosed_at":"2026-09-08T21:23:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:12.705Z"}],"next_cursor":null,"snapshot_revision":"42594"}