{"id":"GO-2026-5762","revision":"e989c16815244133901f7e44f21c1419","records":[{"revision":"e989c16815244133901f7e44f21c1419","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5762","aliases":["CVE-2026-41589","GHSA-xjvp-7243-rg9h"],"title":"Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish","description":"Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish","state":0,"publishedAt":"2026-07-07T16:52:19+00:00","modifiedAt":"2026-07-07T20:30:15.0152195+00:00","affected":[{"ecosystem":"Go","name":"charm.land/wish/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h","https://github.com/charmbracelet/wish/releases/tag/v2.0.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5762","license":"OSV · upstream source license applies","key":"osv:GO-2026-5762","identifiers":["GO-2026-5762","CVE-2026-41589","GHSA-xjvp-7243-rg9h"]},"retained":false,"historicalAffected":[]}],"coverage":[]}