Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

badkeys

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.0PyPIAmendedPublished

    badkeys vulnerable to ASCII control character injection on console via malformed input

    CVE-2026-21439 · GHSA-wjpc-4f29-83h3

    Affected
    • PyPI badkeys <= 0.0.15
    Fixed in
    0.0.16· Vendor fix available
    Issue
    Impact An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. Patches This has been fixed with the following commits: https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a All users should upgrade badkeys to version 0.0.16. Resources https://github.com/badkeys/badkeys/issues/40

    Recommended action: Upgrade to 0.0.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →