CVE-2026-59179

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, @openhop/server passes unauthenticated flow route parameters from GET /api/flows/:id and DELETE /api/flows/:id in packages/server/src/routes.ts to FlowStore.filePath() in packages/server/src/store.ts without an identifier allow-list. The router applies decodeURIComponent to the id, and path.join() then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In packages/server/src/index.ts, CORS origin: true permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to HOST=0.0.0.0 and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.