Product
The @openhop/server package is vulnerable to unauthenticated path traversal, allowing remote attackers to read or delete arbitrary YAML files via unsanitized route parameters in the Flow ID endpoint.