{"cve":"CVE-2026-59179","nvd":{"published":"2026-10-28T14:17:04.907","modified":"2026-10-28T14:17:04.907","status":"Received","description":"OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H","score":8.3},"cwes":["CWE-22"],"references":["https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4","https://github.com/naorsabag/openhop/pull/190","https://github.com/naorsabag/openhop/releases/tag/v0.3.7","https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"],"products":[],"source":"nvd","synced_at":"2026-10-28T14:33:46.215572803+00:00"},"epss":null,"kev":null,"osv":[{"id":"GHSA-g72f-jw3w-mgh7","url":"https://osv.dev/vulnerability/GHSA-g72f-jw3w-mgh7","summary":"@openhop/server: Path Traversal in Flow ID File Operations","modified":"2026-09-10T00:10:58.205429Z","packages":[{"ecosystem":"npm","name":"@openhop/server","purl":"pkg:npm/%40openhop/server","ranges":["<0.3.6"],"fixed":["0.3.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}