openhop (>=0.1.0-beta.3, <=0.3.6) potentially affected by CVE-2026-59179 via @openhop/server (>=0.1.0-beta.1, <=0.3.5)

@openhop/server NPM version =0.1.0-beta.1, =0.1.0-beta.3, =0.3.6 Source cves: CVE-2026-59179 Source advisory: MEND:CVE-2026-59179...

openhop (>=0.1.0-beta.3, <=0.3.6) potentially affected by CVE-2026-59179 via @openhop/server (>=0.1.0-beta.1, <=0.3.5)

@openhop/server NPM version =0.1.0-beta.1, =0.1.0-beta.3, =0.3.6 Source cves: CVE-2026-59179 Source advisory: GHSA-G72F-JW3W-MGH7...

openhop (>=0.1.0-beta.3, <=0.3.6) potentially affected by CVE-2026-59179 via @openhop/server (>=0.1.0-beta.1, <=0.3.5)

@openhop/server NPM version =0.1.0-beta.1, =0.1.0-beta.3, =0.3.6 Source cves: CVE-2026-59179 Source advisory: OSV:GHSA-G72F-JW3W-MGH7...

@openhop/server: Path Traversal in Flow ID File Operations

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

PT-2026-89215

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...