CVE-2026-59179 OpenHop: Path Traversal in Flow ID File Operations
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-59179?
CVE-2026-59179 is a high-severity vulnerability in naorsabag openhop, published on 28 Oct 2026.
Official description
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
Weakness: CWE-22
Which versions are affected by CVE-2026-59179?
2 open source packages ship an affected version, including @openhop/server.
| Package | Affected | Fixed in |
|---|---|---|
@openhop/server npm | All versions | 0.3.6 |
@openhop/server npm | All versions | 0.3.6 |
How do I fix CVE-2026-59179?
Upgrade @openhop/server to 0.3.6 or later.
Is CVE-2026-59179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59179 exists.
Sources
Also known as GHSA-g72f-jw3w-mgh7.