Please report security vulnerabilities privately to zack.scholl+croc@gmail.com.
Patches are especially welcome, they help me implement your findings directly and ensure you receive credit. Thank you for helping keep this project secure!
Security: schollz/croc
Security
SECURITY.md
-
Case-Insensitive Bypass of the `.ssh` Receive-Path Guard in crocGHSA-pcm6-vvg3-3xmh published
Sep 5, 2026 by schollzModerate -
Unsafe handling of received filenames on the receiver: Arbitrary File Deletion via a maliciously named incoming file (croc-marked-files.txt) and, when receiving into $HOME can be chained to remote code executionGHSA-wmw5-q587-gx56 published
Aug 21, 2026 by schollzModerate -
croc symlink metadata can overwrite arbitrary receiver files during file transferGHSA-m6m7-376m-rr8g published
Aug 21, 2026 by schollzModerate
Learn more about advisories related to schollz/croc in the GitHub Advisory Database