153 matches found
magic-wormhole
Magic Wormhole Get things from one computer to another, safely. This package provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories or short pieces of text from one computer to another. The two endpoints are identified by...
Malicious Package
Overview cypress-pm2-wormhole-quark is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
SUSE CVE-2026-42448
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
OPENSUSE-SU-2026:11370-1 python-magic-wormhole-bash-completion-0.24.0-1.1 on GA media
These are all security issues fixed in the python-magic-wormhole-bash-completion-0.24.0-1.1 package on the GA media of openSUSE Tumbleweed...
pycurity (0.0.1), senbai (0.0.1) potentially affected by CVE-2026-42448 via magic-wormhole (0.23.0)
magic-wormhole PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on magic-wormhole and may be impacted: - pycurity 0.0.1 - senbai 0.0.1 Source cves: CVE-2026-42448 Source advisory: OSV:PYSEC-2026-2616...
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
ImpactA receiver who specifies "--output " where that output directory currently exists as a directory. Patches0.24.0 will contain the patch WorkaroundsEnsure local target directories specified by "--output" do not already exist ResourcesPrivate email and Signal communications from a user.Magic...
PYSEC-2026-2616 Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Impact A receiver who specifies "--output " where that output directory currently exists as a directory. Patches 0.24.0 will contain the patch Workarounds Ensure local target directories specified by "--output" do not already exist Resources Private email and Signal communications from a user...
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
ImpactWhat kind of vulnerability is it? Who is impacted?Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This could be used to compromise the receiver's computer.Only the sender of the file the...
PYSEC-2026-2615 Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Impact What kind of vulnerability is it? Who is impacted? Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file th...
PT-2026-59268
Impact What kind of vulnerability is it? Who is impacted? Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorized keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file t...
CVE-2026-42448
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
CVE-2026-42448
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
CVE-2026-42448 wormhole receive, with --output pointing at an existing directory can be path-traversed
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
CVE-2026-42448 wormhole receive, with --output pointing at an existing directory can be path-traversed
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
pycurity (0.0.1), senbai (0.0.1) potentially affected by CVE-2026-42448 via magic-wormhole (0.23.0)
magic-wormhole PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on magic-wormhole and may be impacted: - pycurity 0.0.1 - senbai 0.0.1 Source cves: CVE-2026-42448 Source advisory: MEND:CVE-2026-42448...
CVE-2026-42448 wormhole receive, with --output pointing at an existing directory can be path-traversed
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
EUVD-2026-31947
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
CVE-2026-42448
CVE-2026-42448 affects the Python package magic-wormhole . A vulnerability in the receive path occurs when the receiver specifies --output and that target directory already exists, enabling a path traversal. Documentation in multiple sources confirms this flaw and its fix: upgrade to version 0.2...
CVE-2026-42448
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...
Magic Wormhole Path traversal vulnerability
Magic Wormhole is an open-source, secure cross-computer file transfer tool. Versions of Magic Wormhole prior to 0.24.0 contained a path traversal vulnerability, which was due to the possibility of path traversal when the recipient specified an output directory...