Approved changes feed: RSS · Atom
cpe:2.3:a:charmbracelet:wish:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Charmbracelet (4d5f2a51-e722-5c40-b50f-ae9bb792d84b) |
|---|---|
| Product | Wish (47ddb5ae-b2e9-56f2-b2b6-8395d932348d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41589 |
vulnerable | 2026-06-08 08:03:15.600560 |
Wish has SCP Path Traversal that allows arbitrary file read/write
CRITICAL (9.6)
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.
Published: 2026-05-07T13:17:58.717Z
Updated: 2026-05-07T14:41:57.990Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.