CVE-2026-41589

Go/charm.land/wish/v2 CVE-2026-41589: critical 9.6, EPSS 0.51%

Wish has SCP Path Traversal that allows arbitrary file read/write

Action: Upgrade charm.land/wish/v2 to 2.0.1 or later.

go get charm.land/wish/v2@v2.0.1

Affected

Fixed versions

Sources

• osv: GHSA-xjvp-7243-rg9h
• https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h
• https://nvd.nist.gov/vuln/detail/CVE-2026-41589
• https://github.com/charmbracelet/wish
• https://github.com/charmbracelet/wish/releases/tag/v2.0.1

CVE-2026-41589 · published 2026-04-18T01:09:46Z · modified 2026-07-07T20:41:06.510082917Z · JSON

Go/github.com/charmbracelet/wish CVE-2026-41589: critical 9.6, EPSS 0.51%

Wish has SCP Path Traversal that allows arbitrary file read/write

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-xjvp-7243-rg9h#Go/github.com/charmbracelet/wish
• https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h
• https://nvd.nist.gov/vuln/detail/CVE-2026-41589
• https://github.com/charmbracelet/wish
• https://github.com/charmbracelet/wish/releases/tag/v2.0.1

CVE-2026-41589 · published 2026-04-18T01:09:46Z · modified 2026-07-07T20:41:06.510082917Z · JSON

Go/charm.land/wish/v2 CVE-2026-41589: unknown, EPSS 0.51%

Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish

Action: Upgrade charm.land/wish/v2 to 2.0.1 or later.

go get charm.land/wish/v2@v2.0.1

Affected

Fixed versions

Sources

• osv: GO-2026-5762
• https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h
• https://github.com/charmbracelet/wish/releases/tag/v2.0.1

CVE-2026-41589 · published 2026-07-07T16:52:19Z · modified 2026-07-07T20:30:15.015219540Z · JSON