Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-41589Wish has SCP Path Traversal that allows arbitrary file read/write
Critical 9.6
In plain English
A critical-severity path traversal in wish from charmbracelet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | charm.land/wish/v2 | 2.0.1 | GHSA-xjvp-7243-rg9h |
| Go | charm.land/wish/v2 | 2.0.1 | GO-2026-5762 |
| Go | github.com/charmbracelet/wish | no fix listed | GHSA-xjvp-7243-rg9h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| charmbracelet | wish | >= 2.0.0, < 2.0.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h x_refsource_CONFIRM
- https://github.com/charmbracelet/wish/releases/tag/v2.0.1 x_refsource_MISC