CVE-2026-54590
2 advisories.
PyPI/asyncssh CVE-2026-54590: medium 5.9, EPSS 0.39%
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Action: Upgrade asyncssh to 2.23.1 or later.
pip install asyncssh==2.23.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.23.1 | - |
Fixed versions
| 2.23.1 |
Sources
- osv: GHSA-qr67-gv47-xwwh
- https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-54590
- https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88
- https://github.com/ronf/asyncssh
- https://github.com/ronf/asyncssh/releases/tag/v2.23.1
CVE-2026-54590 · published · modified · JSON
PyPI/asyncssh CVE-2026-54590: medium 5.9, EPSS 0.39%
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Action: Upgrade asyncssh to 2.23.1 or later.
pip install asyncssh==2.23.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.23.1 | - |
Fixed versions
| 2.23.1 |
Sources
- osv: PYSEC-2026-3809
- https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-54590
- https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88
- https://github.com/ronf/asyncssh
- https://github.com/ronf/asyncssh/releases/tag/v2.23.1
- https://pypi.org/project/asyncssh
- https://github.com/advisories/GHSA-qr67-gv47-xwwh
CVE-2026-54590 · published · modified · JSON