Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A receiver who specifies "--output <dir" where that output directory currently exists (as a directory). Patches 0.24.0 will contain the patch Workarounds Ensure local target directories specified by "--output" do not already exist Resources Private email and Signal communications from a user. Magic Wormhole thanks @marduc812
Recommended action: Upgrade to 0.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? Receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorizedkeys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. Patches Has the problem been patched? What versions should users upgrade to? The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version. The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, the receiver can override the sender's filename with the --output or -o option. For example: wormhole receive -o shopping-list.txt will write the file to shopping-list.txt in the local directory,…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.