—PyPI
PYSEC-2026-2615· CVE-2026-32116, GHSA-4g4c-mfqg-pj8rMagic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Modified: 7/13/2026
package
PyPI/magic-wormhole
pkg:pypi/magic-wormhole
LOW3.5PyPI
PYSEC-2026-2616· CVE-2026-42448, GHSA-cf92-gfcw-6v53Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Modified: 7/13/2026
HIGHPyPI
GHSA-4g4c-mfqg-pj8r· CVE-2026-32116, PYSEC-2026-2615Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Modified: 7/13/2026
LOW3.5PyPI
GHSA-cf92-gfcw-6v53· CVE-2026-42448, PYSEC-2026-2616Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Modified: 7/13/2026