Charmbracelet wish: Path traversal vulnerability (CVE-2026-53980)
Charmbracelet wish contains a path traversal vulnerability in the git middleware that allows authenticated SSH users to access arbitrary repositories outside the intended root directory.
CVE search metadata
CVE search record: CVE-2026-53980. Severity: high. CVSS: 8.1. KEV: no. Product: Wish (< 2.0.5). Brief: Charmbracelet wish: Path traversal vulnerability (CVE-2026-53980). Brief link: https://feed.craftedsignal.io/briefs/2026-11-charmbracelet-wish-path-traversal/
Triage facts
Revision 2- Applicability
- Wish (< 2.0.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 4 public sources
- Freshness
- Revision 2Nov 6, 17:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
new product
Changed: affected_products, affected_vendors, claim_state, cpes, lastmod, references, updates
Sources: 1
Charmbracelet wish contains a path traversal vulnerability in its git middleware (charm.land/wish/v2). The flaw stems from a flawed forward-slash-count containment check in git.Middleware(). Authenticated SSH users can supply crafted repository paths - such as single-depth paths like '../evil' or, on Windows, payloads like '....\evil' - to bypass the guard. This allows users to read or write arbitrary repositories outside the intended root directory via git-upload-pack, git-upload-archive, or git-receive-pack.