Skip to content
OpenAdvisories

Package · Go

github.com/charmbracelet/wish

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.6
    CVE-2026-41589

    Wish has SCP Path Traversal that allows arbitrary file read/write

    Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server,…

    charmbracelet wish github.com/charmbracelet/wish charm.land/wish/v2 Go