CVE-2026-42448

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...

dropship (=0.0.5), openadapt (>=0.15.1 <=0.46.0) +3 more potentially affected by CVE-2026-42448 via magic-wormhole (>=0.11.2 <=0.13.0)

magic-wormhole PYPI version =0.11.2, =0.15.1, =0.1.0, =0.1.0, =0.2.0, =0.7.0 Source cves: CVE-2026-42448 Source advisory: SNYK:PYTHON-MAGICWORMHOLE-16438994...

CVE-2026-42448

creationtimestamp| type| source ---|---|--- 2026-05-06 12:07:43+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ml6o3gh4nc2b 2026-05-26 19:13:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmrp6zqwxp2n...