Nixpkgs security tracker

Published

Permalink CVE-2026-42448

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 4 days ago
@LeSuisse ignored
8 packages
- wormhole-rs
- magic-wormhole-rs
- python314Packages.magic-wormhole-mailbox-server
- python313Packages.magic-wormhole-mailbox-server
- python312Packages.magic-wormhole-mailbox-server
- python314Packages.magic-wormhole-transit-relay
- python313Packages.magic-wormhole-transit-relay
- python312Packages.magic-wormhole-transit-relay
2 weeks, 4 days ago
@LeSuisse ignored maintainer @mjoerg 2 weeks, 4 days ago maintainer.ignore
@LeSuisse accepted 2 weeks, 4 days ago
@LeSuisse published on GitHub 2 weeks, 4 days ago

wormhole receive, with --output pointing at an existing directory can be path-traversed

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.