CVE-2026-59179: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59179 is a Path Traversal vulnerability in the @openhop/server npm package (OpenHop) that allows unauthenticated attackers to read or delete arbitrary .yaml files outside the configured flow directory. It affects all versions up to and including 0.3.5, with version 0.3.6 containing the fix. The vulnerability was first published on June 20, 2026, and added to the GitHub Advisory Database on September 9, 2026. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, OpenHop Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The FlowStore.filePath() method in packages/server/src/store.ts:52–53 constructs filesystem paths by passing the caller-supplied id directly into Node.js path.join() without any sanitization or allowlist validation. The id value originates from unauthenticated Fastify HTTP route parameters on GET /api/flows/:id and DELETE /api/flows/:id; Fastify's underlying router (find-my-way) applies decodeURIComponent to route parameters, so a URL segment like ..%2Fvictim is decoded to ../victim before reaching application code, causing path.join('/data/flows', '../victim.yaml') to resolve to /data/victim.yaml — outside the configured store. Compounding the issue, CORS was configured with origin: true (allow all origins), enabling exploitation via a malicious webpage against loopback-bound instances, and Docker deployments default to HOST=0.0.0.0, making the server directly reachable from the network without authentication (GitHub Advisory, OpenHop Advisory).

Successful exploitation allows an unauthenticated attacker to (1) read the contents of any .yaml file accessible to the OpenHop process — potentially leaking application secrets, credentials, or configuration data — and (2) permanently delete any .yaml file reachable by the process, causing irreversible data loss or disruption of dependent services. The .yaml extension restriction limits confidentiality impact to YAML-format files (C:L), but the delete path has high integrity and availability impact (I:H, A:H). Both local users (via CORS-enabled browser-based cross-origin requests to localhost) and remote users (via Docker's default HOST=0.0.0.0 binding) are affected (GitHub Advisory).

A public proof-of-concept (PoC) exploit — including a Python script (poc.py) and a Docker-based reproduction environment — is included in the official security advisory, making exploitation straightforward. No authentication or special privileges are required; user interaction is needed only for the browser-based CORS attack vector against local instances. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the CVE status remains "Reserved." No EPSS score or CISA KEV catalog entry has been reported (GitHub Advisory, OpenHop Advisory).

1. Reconnaissance: Identify OpenHop server instances using network scanning tools (e.g., Shodan, Censys, or nmap) targeting the default port 8799, or identify local instances running on localhost:8799. Docker deployments with HOST=0.0.0.0 are directly reachable from the network.
2. Identify target files: Determine the path of sensitive .yaml files relative to the configured OPENHOP_DATA_DIR (e.g., /data/flows/). Files one directory level up (e.g., /data/victim.yaml) are reachable with a single ../ traversal.
3. Craft traversal payload: Encode the path traversal sequence as ..%2F (percent-encoded /) to bypass any literal slash splitting by the router. For example, to read /data/victim.yaml, use the payload ..%2Fvictim.
4. Execute read attack: Send a crafted GET request preserving the encoded path: curl -i --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fvictim'. The server decodes the parameter, resolves the path outside the flow store, and returns the file contents as JSON with HTTP 200.
5. Execute delete attack: Send a crafted DELETE request: curl -i -X DELETE --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fdelete-me'. The server permanently deletes the target file and responds with HTTP 204.
6. Browser-based attack (local instances): Host a malicious webpage that uses JavaScript fetch() to send cross-origin requests to http://localhost:8799/api/flows/..%2Ftarget, exploiting the permissive CORS: origin: true configuration to exfiltrate or destroy files on a victim's local machine when they visit the page (GitHub Advisory, OpenHop Advisory).

• Network: HTTP GET or DELETE requests to /api/flows/ endpoints containing %2F, .., or other path traversal sequences in the flow ID segment (e.g., /api/flows/..%2Fvictim, /api/flows/..%2Fdelete-me); cross-origin requests to port 8799 from unexpected browser origins.
• Logs: Fastify/OpenHop access logs showing requests to /api/flows/:id where the decoded id parameter contains ../ or other directory traversal patterns; HTTP 200 responses to GET requests for flow IDs that do not correspond to any legitimate flow in the store; HTTP 204 responses to DELETE requests for non-existent flow IDs.
• File System: Unexpected disappearance of .yaml files outside the configured OPENHOP_DATA_DIR directory (e.g., files in the parent directory of the flow store); access timestamps updated on .yaml files outside the flow store directory that should not be accessed by the OpenHop process.

Upgrade @openhop/server to version 0.3.6, which introduces a strict allowlist regex (/^[A-Za-z0-9_-]+$/) validated in assertValidFlowId() before any filesystem operation, and restricts CORS to loopback origins only (localhost and 127.0.0.1) instead of allowing all origins. The fix also adds the pattern constraint to Fastify route parameter schemas so invalid IDs are rejected at the routing layer with HTTP 400. As a temporary workaround for those unable to upgrade immediately, restrict network access to the OpenHop server using firewall rules or bind it to 127.0.0.1 instead of 0.0.0.0 to limit the attack surface (GitHub Commit, GitHub Advisory).