PyPI/magic-wormhole CVE-2026-32116: high, EPSS 0.36%

Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Action: Upgrade magic-wormhole to 0.23.0 or later.

pip install magic-wormhole==0.23.0

Affected

Fixed versions

Sources

• osv: GHSA-4g4c-mfqg-pj8r
• https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-4g4c-mfqg-pj8r
• https://nvd.nist.gov/vuln/detail/CVE-2026-32116
• https://github.com/magic-wormhole/magic-wormhole

CVE-2026-32116 · published 2026-03-13T15:40:20Z · modified 2026-07-13T16:42:44.471414306Z · JSON