Detections
Analytics

SCA: security update for @openhop/server (GHSA-g72f-jw3w-mgh7)

high Tenable Self-Hosted Container Security Plugin ID 447875

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes
 unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in
 `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an
 identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then
 normalizes traversal outside the configured flow directory after appending the .yaml extension. An
 attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files
 outside that directory, exposing configuration or secrets and disrupting dependent services. In
 `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious
 webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit
 direct unauthenticated network access. This issue is fixed in repository release 0.3.7. (CVE-2026-59179)

Solution

Update the @openhop/server library and its related packages to version 0.3.6 or later.

See Also

https://github.com/advisories/GHSA-g72f-jw3w-mgh7

Plugin Details

Severity: High

ID: 447875

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 9/10/2026

Updated: 10/29/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C

CVSS Score Source: CVE-2026-59179

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/9/2026

Vulnerability Publication Date: 9/9/2026

Reference Information

CVE: CVE-2026-59179

cwe: CWE-22