GitHub Advisoryadvisory · PyPI
GHSA-wjpc-4f29-83h3 badkeys vulnerable to ASCII control character injection on console via malformed input
LOW
Official page ↗
- Aliases
- CVE-2026-21439
- Ecosystem
- PyPI
- Packages
- badkeys
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- Weaknesses
- CWE-150
- Reviewed
- 2026-01-05
Affected packages
• PyPI badkeys: < 0.0.16 → fixed in 0.0.16
Description
Impact
An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.
Patches
This has been fixed with the following commits:
https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a
All users should upgrade `badkeys` to version 0.0.16.
Resources
https://github.com/badkeys/badkeys/issues/40
Related
Alias · CVE (1)
- CVE-2026-21439 badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. vulnerability
Weakness · CWE (1)
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness
References
- https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-21439 advisory
- https://github.com/badkeys/badkeys/issues/40 web
- https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a web
- https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 web
- https://github.com/badkeys/badkeys package