CVE-2026-53980 · Package
NO FIX YET · SEE WHAT TO DO
Charmbracelet wish, a Go library for building SSH servers, has a path traversal flaw in its git middleware. An authenticated SSH user can supply crafted repository paths to read or write Git repositories outside the configured root directory.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only servers built with charm.land/wish/v2 that use the git middleware and accept SSH logins from users. Exposure depends on whether untrusted or semi-trusted users can authenticate over SSH and push or fetch repositories. Servers that do not use the git middleware are not affected.
Not affected if no-git-middleware, unauthenticated-only-access
Who cares git-hosting, go, ssh, wish
charm.land/wish/v2 in go.mod or go list -m charm.land/wish/v2git.Middleware() usage in your Go SSH server codecharm.land/wish/v2 before 2.0.5: move to 2.0.5 or laterCharmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ....\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.