CVE-2026-53980
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
67/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
None
VC:
High
VI:
High
VA:
None
Description
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| charmbracelet | wish | 0 < 2.0.5 |
| charmbracelet | wish | 0 < 2.0.5 |
| charmbracelet | wish | 0 < 2.0.5 |