https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:50:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32116 <p><strong>Affected:</strong> magic-wormhole</p> <p>Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver&#39;s computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.</p> <p><strong>Affected:</strong> magic-wormhole</p> <p>Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver&#39;s computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-32116 https://vulnerability.circl.lu/vuln/ghsa-4g4c-mfqg-pj8r <p><strong>Affected:</strong> PyPI: magic-wormhole</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>Receiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver&#39;s computer.</p> <p>Only the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.</p> <p>The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>As a workaround, the receiver can override the sender&#39;s filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>Incoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard…</p> <p><strong>Affected:</strong> PyPI: magic-wormhole</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>Receiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver&#39;s computer.</p> <p>Only the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.</p> <p>The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>As a workaround, the receiver can override the sender&#39;s filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>Incoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard…</p> https://vulnerability.circl.lu/vuln/ghsa-4g4c-mfqg-pj8r https://vulnerability.circl.lu/vuln/pysec-2026-2615 <p><strong>Affected:</strong> PyPI: magic-wormhole</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>Receiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver&#39;s computer.</p> <p>Only the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.</p> <p>The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>As a workaround, the receiver can override the sender&#39;s filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>Incoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard…</p> <p><strong>Affected:</strong> PyPI: magic-wormhole</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>Receiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver&#39;s computer.</p> <p>Only the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.</p> <p>The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>As a workaround, the receiver can override the sender&#39;s filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>Incoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2615