The honojs hono web application framework before version 4.12.12 contains a path traversal vulnerability in its toSSG() static site generation function. When dynamic route parameters are used via ssgParams, an attacker can supply crafted values that cause the generated file paths to escape the configured output directory. This improper limitation of pathname to a restricted directory (CWE-22) can lead to files being written outside the intended directory during static site generation. The vulnerability has a CVSS 4.0 base score of 5.9 (medium severity) and requires local access with high attack complexity and no privileges. The issue is fixed in version 4.12.12.

Exploitation of this vulnerability allows an attacker to write files outside the intended output directory during static site generation, potentially leading to unauthorized file creation or modification on the host system. The CVSS vector indicates local attack vector with high complexity and no privileges required, but user interaction is not needed. There are no known exploits in the wild at this time.

Upgrade to hono version 4.12.12 or later, where this path traversal vulnerability in toSSG() has been fixed. Since the vendor advisory confirms the issue is resolved in 4.12.12, applying this official fix is the recommended remediation. Patch status is not explicitly stated beyond this version update, so verify with the vendor for any additional guidance.