{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980) · updates",
  "home_page_url": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980",
  "feed_url": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/feed.json",
  "description": "Charmbracelet Wish (SSH server middleware for Go) before 2.0.5 has a path traversal in the git middleware that lets authenticated SSH users escape the configured repository directory with crafted repo paths. Fixed in v2.0.5 (commit 533db0d). CVSS 8.1 per NVD/VulnCheck.",
  "language": "en",
  "_pwn": {
    "slug": "charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/feed.xml",
    "llms": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/llms.txt",
    "json": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-b6b02833",
      "url": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-b6b02833",
      "title": "Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5.",
      "content_text": "Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-53980",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53980",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-03b375d4",
      "url": "https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-03b375d4",
      "title": "Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir.",
      "content_text": "Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir.\n\nSource: https://github.com/charmbracelet/wish/releases/tag/v2.0.5",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/charmbracelet/wish/releases/tag/v2.0.5",
      "tags": [
        "high"
      ]
    }
  ]
}