{"id":"EUVD-2026-112080","enisaUuid":"dc0ed6f1-bbd4-32d3-80c0-8032739cefb9","description":"OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST\u003d0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.","datePublished":"Oct 28, 2026, 1:14:13 PM","dateUpdated":"Oct 29, 2026, 6:33:40 PM","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H","references":"https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7\nhttps://github.com/naorsabag/openhop/pull/190\nhttps://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4\nhttps://github.com/naorsabag/openhop/releases/tag/v0.3.7\n","aliases":"CVE-2026-59179\nGHSA-g72f-jw3w-mgh7\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"102d9871-871a-379f-b3e1-3f4864333043","product":{"name":"openhop","vendor":{"name":"naorsabag"}},"product_version":"\u003c 0.3.7"}],"enisaIdVendor":[{"id":"dd6bfacc-0e95-3dcc-a486-64739fadeadc","vendor":{"name":"naorsabag"}}],"enisaIdVulnerability":[{"id":"b8b399c1-62a7-30c3-ac80-b0ec638aba81","vulnerability":{"id":"CVE-2026-59179","description":"OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST\u003d0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.","datePublished":"Oct 28, 2026, 1:14:13 PM","dateUpdated":"Oct 29, 2026, 6:33:40 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H","references":"https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7\nhttps://github.com/naorsabag/openhop/pull/190\nhttps://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4\nhttps://github.com/naorsabag/openhop/releases/tag/v0.3.7\n","enisa_id":"EUVD-2026-112080\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 30, 2026, 12:00:39 PM","vulnerabilityProduct":[{"id":"ad2e9337-c5fd-3d9a-a5d0-48387d77974a","product":{"name":"openhop","vendor":{"name":"naorsabag"}},"product_version":"\u003c 0.3.7"}],"vulnerabilityVendor":[{"id":"d7ccbbe2-ece5-3682-a183-98f7bb3ceded","vendor":{"name":"naorsabag"}}]}},{"id":"f2e51d7f-68e3-3186-a019-5bf888790006","vulnerability":{"id":"GHSA-g72f-jw3w-mgh7","description":"@openhop/server: Path Traversal in Flow ID File Operations","datePublished":"Sep 9, 2026, 11:51:59 PM","dateUpdated":"Sep 9, 2026, 11:51:59 PM","baseScore":0.0,"references":"https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7\nhttps://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4\nhttps://github.com/naorsabag/openhop\n","enisa_id":"EUVD-2026-112080\n","aliases":"CVE-2026-59179\nGHSA-g72f-jw3w-mgh7\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}