GHSA-cf92-gfcw-6v53
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | magic-wormhole | >= 0.23.0, < 0.24.0 | 0.24.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A receiver who specifies "--output <dir>" where that output directory currently exists (as a directory).
### Patches
0.24.0 will contain the patch
### Workarounds
Ensure local target directories specified by "--output" do not already exist
### Resources
Private email and Signal communications from a user.
Magic Wormhole thanks @marduc812
References
External links from the advisory. They lead to third-party sites.