NPM · AUGUST 2026 · EARLY WARNING

luci-app-openvpn npm Package Vulnerability: Critical CVE-2026-72841

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.9
Affected component
luci-app-openvpn (npm)
Patched version
Not yet available
CVE-2026-72841

An early warning has been issued for a critical vulnerability in the luci-app-openvpn npm package. This vulnerability, tracked as CVE-2026-72841, could allow authenticated users to perform path traversal and write arbitrary files, potentially leading to persistent root code execution.

What happened

The luci-app-openvpn npm package reportedly fails to properly validate the instance_name2 parameter during file upload. This flaw allows authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers could exploit this to upload malicious payloads, gaining persistent root code execution by placing SSH keys in system directories accessible on reboot.

This vulnerability was first flagged on 2026-08-13T22:17:23.813000+00:00. The CVSS score is 9.9, indicating a critical severity level. No authoritative version range has been published yet, and there is no indication that this vulnerability has been exploited in the wild.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If luci-app-openvpn is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using the luci-app-openvpn npm package, you may be affected. No authoritative version range has been published yet, so it is advisable to assume potential risk and take precautionary measures.

What should I do right now?

Monitor the primary sources for updates on a patched version of luci-app-openvpn. As a precautionary measure, rotate any SSH keys in environments where luci-app-openvpn is used.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats