Vulnerability-Lookup

PYSEC-2026-1212

Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:23

Details

Impact

An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes.

Patches

This has been fixed with the following commits: https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a

All users should upgrade badkeys to version 0.0.16.

Resources

https://github.com/badkeys/badkeys/issues/40

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Impacted products

Name	purl
badkeys	pkg:pypi/badkeys

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "badkeys",
        "purl": "pkg:pypi/badkeys"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.11",
        "0.0.12",
        "0.0.13",
        "0.0.14",
        "0.0.15",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.0.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21439",
    "GHSA-wjpc-4f29-83h3"
  ],
  "details": "### Impact\n\nAn attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.\n\n### Patches\n\nThis has been fixed with the following commits:\nhttps://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087\nhttps://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a\n\nAll users should upgrade `badkeys` to version 0.0.16.\n\n### Resources\n\nhttps://github.com/badkeys/badkeys/issues/40",
  "id": "PYSEC-2026-1212",
  "modified": "2026-07-07T17:23:49.361145Z",
  "published": "2026-07-07T16:03:14.719026Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/issues/40"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/badkeys/badkeys"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/badkeys"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-wjpc-4f29-83h3"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "badkeys vulnerable to ASCII control character injection on console via malformed input"
}

CVE-2026-21439 (GCVE-0-2026-21439)

Vulnerability from cvelistv5 – Published: 2026-01-05 23:51 – Updated: 2026-01-06 19:01

Title

badkeys vulnerable to ASCII control character injection on console via malformed input

Summary

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/badkeys/badkeys/security/advis…	x_refsource_CONFIRM
https://github.com/badkeys/badkeys/issues/40	x_refsource_MISC
https://github.com/badkeys/badkeys/commit/635a2f3…	x_refsource_MISC
https://github.com/badkeys/badkeys/commit/de631f6…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
badkeys	badkeys	Affected: < 0.0.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21439",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:24:28.663559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:01:48.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/badkeys/badkeys/issues/40"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "badkeys",
          "vendor": "badkeys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T23:51:35.670Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3"
        },
        {
          "name": "https://github.com/badkeys/badkeys/issues/40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/badkeys/badkeys/issues/40"
        },
        {
          "name": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a"
        },
        {
          "name": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087"
        }
      ],
      "source": {
        "advisory": "GHSA-wjpc-4f29-83h3",
        "discovery": "UNKNOWN"
      },
      "title": "badkeys vulnerable to ASCII control character injection on console via malformed input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21439",
    "datePublished": "2026-01-05T23:51:35.670Z",
    "dateReserved": "2025-12-29T03:00:29.275Z",
    "dateUpdated": "2026-01-06T19:01:48.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-WJPC-4F29-83H3

Vulnerability from github – Published: 2026-01-05 19:42 – Updated: 2026-01-06 16:07

Summary

badkeys vulnerable to ASCII control character injection on console via malformed input

Details

Impact

Patches

All users should upgrade badkeys to version 0.0.16.

Resources

https://github.com/badkeys/badkeys/issues/40

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.15"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "badkeys"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-05T19:42:12Z",
    "nvd_published_at": "2026-01-06T00:15:49Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nAn attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.\n\n### Patches\n\nThis has been fixed with the following commits:\nhttps://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087\nhttps://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a\n\nAll users should upgrade `badkeys` to version 0.0.16.\n\n### Resources\n\nhttps://github.com/badkeys/badkeys/issues/40",
  "id": "GHSA-wjpc-4f29-83h3",
  "modified": "2026-01-06T16:07:15Z",
  "published": "2026-01-05T19:42:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/issues/40"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/badkeys/badkeys"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "badkeys vulnerable to ASCII control character injection on console via malformed input"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2026-1212

Impact

Patches

Resources

CVE-2026-21439 (GCVE-0-2026-21439)

GHSA-WJPC-4F29-83H3

Impact

Patches

Resources

Tags

Sightings

Nomenclature