CVE-2026-42448
2 advisories.
PyPI/magic-wormhole CVE-2026-42448: low 3.5, EPSS 0.29%
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Action: Upgrade magic-wormhole to 0.24.0 or later.
pip install magic-wormhole==0.24.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.23.0 | 0.24.0 | - |
Fixed versions
| 0.24.0 |
Sources
- osv: GHSA-cf92-gfcw-6v53
- https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53
- https://nvd.nist.gov/vuln/detail/CVE-2026-42448
- https://github.com/magic-wormhole/magic-wormhole
CVE-2026-42448 · published · modified · JSON
PyPI/magic-wormhole CVE-2026-42448: low 3.5, EPSS 0.29%
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Action: Upgrade magic-wormhole to 0.24.0 or later.
pip install magic-wormhole==0.24.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.23.0 | 0.24.0 | - |
Fixed versions
| 0.24.0 |
Sources
- osv: PYSEC-2026-2616
- https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53
- https://nvd.nist.gov/vuln/detail/CVE-2026-42448
- https://github.com/magic-wormhole/magic-wormhole
- https://pypi.org/project/magic-wormhole
- https://github.com/advisories/GHSA-cf92-gfcw-6v53
CVE-2026-42448 · published · modified · JSON