Magic Wormhole allows the sender to transmit files to the receiver. From versions 0.21.0 through before 0.23.0, the receive operation did not guard against overwriting existing local files; the receiver could overwrite sensitive files such as ~/.ssh/authorized_keys and .bashrc, effectively modifying the user’s environment and authentication configuration. This introduces a Local File Overwrite weakness (CWE‑22) and creates the possibility for an attacker to gain unauthorized access or execute arbitrary code on the victim’s machine.

The vulnerability affects the magic‑wormhole project, specifically versions 0.21.0 up to but not including 0.23.0. Any instance running these versions that accepts a receive operation from an untrusted sender is impacted.

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is less than 1%, suggesting low current exploitation probability, and it is not listed in the CISA KEV catalog. Attack requires the sender to run wormhole send and the receiver to execute wormhole receive; the attacker must have local access to a device that will accept the file, but once performed, a malicious file can replace critical configuration files. The fix is to upgrade to 0.23.0 or later, which removes the vulnerability.