CVE-2026-59179: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59179 is a Path Traversal vulnerability in the @openhop/server npm package (OpenHop) that allows unauthenticated attackers to read or delete arbitrary .yaml files outside the configured flow directory. It affects all versions up to and including 0.3.5, with version 0.3.6 containing the fix. The vulnerability was first published on June 20, 2026, and added to the GitHub Advisory Database on September 9, 2026. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, OpenHop Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The FlowStore.filePath() method in packages/server/src/store.ts:52–53 constructs filesystem paths by passing the caller-supplied id directly into Node.js path.join() without any sanitization or allowlist validation. The id value originates from unauthenticated Fastify HTTP route parameters on GET /api/flows/:id and DELETE /api/flows/:id; Fastify's underlying router (find-my-way) applies decodeURIComponent to route parameters, so a URL segment like ..%2Fvictim is decoded to ../victim before reaching application code, causing path.join('/data/flows', '../victim.yaml') to resolve to /data/victim.yaml outside the configured directory. Compounding the issue, CORS was configured with origin: true (allow all origins), enabling exploitation via a malicious webpage against loopback-bound instances, and Docker deployments default to HOST=0.0.0.0, making the server directly reachable from the network without authentication (GitHub Advisory, OpenHop Advisory).

An unauthenticated attacker can exploit this vulnerability to (1) read the contents of any .yaml file accessible to the OpenHop process, potentially leaking application secrets, configuration data, or other YAML-serialized sensitive information, and (2) permanently delete any .yaml file reachable by the process, causing irreversible data loss or disruption of dependent services. The confidentiality impact is limited to .yaml-format files due to the hardcoded file extension, but the integrity and availability impacts are high because the delete path imposes no such restriction on which .yaml files can be targeted. Local users are also at risk via browser-based cross-origin attacks due to the permissive CORS policy (GitHub Advisory, OpenHop Advisory).

A public proof-of-concept (PoC) exploit — including a Python script (poc.py) and Docker-based reproduction environment — was published alongside the advisory, making exploitation straightforward (GitHub Advisory). No authentication or special privileges are required; the only precondition is network access to the server (or browser access to a victim running OpenHop locally). No in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV catalog listing has been reported for this CVE at this time.

1. Reconnaissance: Identify OpenHop server instances using network scanning tools (e.g., Shodan, Censys, or nmap) targeting the default port 8799, or identify local users running openhop serve by hosting a malicious webpage.
2. Confirm target version: Send a GET /api/flows request to enumerate existing flows and confirm the server is running a vulnerable version (@openhop/server ≤ 0.3.5).
3. Craft path traversal payload: Construct a URL with a percent-encoded traversal sequence. For example, to read a file one directory above the flow store: GET /api/flows/..%2Fvictim (the %2F encodes /, bypassing literal path splitting by the router).
4. Execute read attack: Send the crafted request using a tool that does not normalize the path (e.g., curl --path-as-is):

   curl -i --path-as-is 'http://TARGET:8799/api/flows/..%2Fvictim'

   The server decodes ..%2Fvictim to ../victim, resolves the path to /data/victim.yaml, and returns its contents as JSON with HTTP 200.
5. Execute delete attack: Send a DELETE request with a traversal payload to permanently remove a target .yaml file:

   curl -i -X DELETE --path-as-is 'http://TARGET:8799/api/flows/..%2Fdelete-me'

   The server responds HTTP 204 and the file is deleted.
6. Browser-based attack (local instances): Host a malicious webpage that issues cross-origin fetch() requests to http://localhost:8799/api/flows/..%2Ftarget — the permissive CORS policy (origin: true) allows the browser to complete the request against the victim's local OpenHop instance.
7. Automated exploitation: Use the published poc.py script for automated read and delete traversal: python3 poc.py 127.0.0.1 8799 (GitHub Advisory, OpenHop Advisory).

• Network: HTTP GET or DELETE requests to /api/flows/ endpoints containing %2F, .., or other path traversal sequences in the flow ID segment; unexpected cross-origin requests to port 8799 from browser origins other than localhost or 127.0.0.1.
• Logs: Fastify/Node.js access logs showing requests such as GET /api/flows/..%2F<filename> or DELETE /api/flows/..%2F<filename> returning HTTP 200 or 204 respectively; log entries with URL-encoded slash characters (%2F) in the :id route parameter.
• File System: Unexpected disappearance of .yaml files outside the configured OPENHOP_DATA_DIR (e.g., /data/*.yaml when the flow store is /data/flows/); access timestamps updated on .yaml files outside the flow store directory.
• Process: Unusual file read or unlink system calls by the OpenHop Node.js process targeting paths outside the configured data directory, observable via auditd or strace (GitHub Advisory).

Upgrade @openhop/server to version 0.3.6, which introduces a strict allowlist regex (/^[A-Za-z0-9_-]+$/) validated in assertValidFlowId() before any filesystem operation, and restricts CORS to loopback origins only (localhost and 127.0.0.1) instead of allowing all origins (Patch Commit, OpenHop Advisory). As a temporary workaround for those unable to upgrade immediately, restrict network access to the OpenHop server using firewall rules or bind the server to 127.0.0.1 instead of 0.0.0.0 to prevent direct remote exploitation. Additionally, ensure the OpenHop process runs with the minimum necessary filesystem permissions to limit the scope of files that could be read or deleted via traversal.

The vulnerability was reported by EQSTLab (reporter: useworld, analyst role) and published by the repository maintainer naorsabag (OpenHop Advisory). No significant broader media coverage or notable community commentary beyond the advisory and patch has been identified at this time.