CVE-2026-32116 json
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
published 2026-03-12 7 mo ago modified 2026-07-13 3 mo ago also GHSA-4g4c-mfqg-pj8r , PYSEC-2026-2615 , EUVD-2026-11643
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.
Patch / fix
- pypi magic-wormhole 0.23.0
- magic-wormhole_project magic_wormhole 0.23.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | magic-wormhole | >=0.21.0, <0.23.0 |
0.23.0 |
Affected products
- magic-wormhole magic-wormhole
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/magic-wormhole/magic-wormhole/security/advisories/GHSA-4g4c-mfqg-pj8r
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-32116
advisory
-
github.com
/magic-wormhole/magic-wormhole
package
-
pypi.org
/project/magic-wormhole
package
-
github.com
/advisories/GHSA-4g4c-mfqg-pj8r
advisory
Sources
- CVE List CVE-2026-32116
- GitHub Advisory GHSA-4g4c-mfqg-pj8r
- NVD CVE-2026-32116
- OSV PYSEC-2026-2615
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.