CVE-2026-32116: Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

What kind of vulnerability is it? Who is impacted?

Receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver’s computer.

Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.