Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.

The version of Langflow installed on the remote host is 1.0.x prior to 1.13.0. It is, therefore, affected by multiple vulnerabilities:

  - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security     restrictions due to improper authentication. (CVE-2026-93680)

  - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary     code due to improper control of code generation. (CVE-2026-110186)

  - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged     authenticated account to cause the Agentic Assistant to generate or submit component code     using these unblocked patterns, resulting in arbitrary operating system command execution     on the server. (CVE-2026-110193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until
    4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still
    write files outside the configured output directory when a route parameter contains consecutive parent-
    directory segments. Static site generation builds each output path from the route path and values supplied
    through ssgParams, then verifies that the result stays inside the output directory using the same
    normalization routine that built the path. That routine does not fully collapse runs of consecutive
    parent-directory segments, allowing a path that the check accepts to resolve outside the output directory,
    and the check also treats output directories that differ in how they are rooted as equivalent. This arises
    when an application generates a static site from route parameter values it does not fully control, such as
    slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files
    elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability
    affects build-time static site generation only; request-time routing and applications with entirely
    developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.
    (CVE-2026-84365)

ID	Name	Product	Family	Type	Severity
375489	Langflow 1.0.x < 1.13.0 Multiple Vulnerabilities	Nessus	Artificial Intelligence	Combined	critical
458221	Echo: hono: security update to 4.13.5	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458221	Echo: hono: security update to 4.13.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-84365

medium

Tenable Plugins

critical

medium

medium