magic-wormhole
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| magic-wormhole | 2 | – | May 26, 2026 |
Exploited and recent CVEs
- CVE-2026-42448 wormhole receive, with --output pointing at an existing directory can be path-traversed 0.2%
- CVE-2026-32116 Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite 0.4%