Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980)

Charmbracelet Wish

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Charmbracelet Wish (SSH server middleware for Go) before 2.0.5 has a path traversal in the git middleware that lets authenticated SSH users escape the configured repository directory with crafted repo paths. Fixed in v2.0.5 (commit 533db0d). CVSS 8.1 per NVD/VulnCheck.

Why this severity: CVSS 8.1; authenticated SSH users can escape the configured git repo directory

Started
Nov 6, 2026
CVE
CVE-2026-53980

Follow this incident

Discuss on X ↗

Affected

  • charm.land/wish/v2 before 2.0.5

Fixed in

  • 2.0.5

Timeline2

  1. NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5.

  2. Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir.

Advisories3

Notes & caveats

Authenticated SSH required. Separate from SCP sibling-directory fix also in 2.0.5.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo