Magic Wormhole
Approved changes feed: RSS · Atom
cpe:2.3:a:magic-wormhole:magic-wormhole:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Magic Wormhole (0b1c0620-1721-5167-be15-b9e46ea0df4d) |
|---|---|
| Product | Magic Wormhole (94330bbb-1c7f-587b-93ec-77bfea1e6bc7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42448 |
vulnerable | 2026-06-08 08:03:16.316983 |
wormhole receive, with --output pointing at an existing directory can be path-traversed
LOW (3.5)
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.
Published: 2026-05-26T17:57:20.946Z
Updated: 2026-05-27T13:17:27.943Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32116 |
vulnerable | 2026-06-08 07:57:16.693535 |
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.
Published: 2026-03-12T17:40:49.791Z
Updated: 2026-03-13T16:24:27.152Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.