magic-wormhole vulnerabilities (PyPI)

2 vulnerabilities.

• magic-wormhole PyPI wormhole receive, with --output pointing at an existing directory can be path-traversed CVE-2026-42448 Fix available 3.5 LowMay 6, 2026
• magic-wormhole PyPI Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite CVE-2026-32116 Fix available 8.2 HighMarch 12, 2026