https://feed.craftedsignal.io/vendors/charmbracelet/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:26:24 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-charmbracelet-wish-path-traversal/Fri, 06 Nov 2026 17:26:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-charmbracelet-wish-path-traversal/Charmbracelet wish contains a path traversal vulnerability in the git middleware that allows authenticated SSH users to access arbitrary repositories outside the intended root directory.<p>Charmbracelet wish contains a path traversal vulnerability in its git middleware (charm.land/wish/v2). The flaw stems from a flawed forward-slash-count containment check in git.Middleware(). Authenticated SSH users can supply crafted repository paths - such as single-depth paths like '../evil' or, on Windows, payloads like '....\evil' - to bypass the guard. This allows users to read or write arbitrary repositories outside the intended root directory via git-upload-pack, git-upload-archive, or git-receive-pack.</p> highadvisory