Read the docs
TI-2026-17324 Aliases CVE-2026-21439GHSA-wjpc-4f29-83h3

badkeys vulnerable to ASCII control character injection on console via malformed input

Priority MEDIUM 44CWE-150Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed badkeys (badkeys): 0.0.16badkeys (PyPI): 0.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
badkeysbadkeysbefore 0.0.160.0.16Patch availableCNA
—badkeys (PyPI)before 0.0.160.0.16Patch availableGHSA-wjpc-4f29-83h3
  • badkeys Vendorbadkeys Affected before 0.0.16 Fixed in 0.0.16 Patch available CNA
  • badkeys (PyPI) Vendor— Affected before 0.0.16 Fixed in 0.0.16 Patch available GHSA-wjpc-4f29-83h3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:badkeys:badkeys:*:*:*:*:*:python:*:*before 0.0.16Vulnerablebadkeys
  • cpe:2.3:a:badkeys:badkeys:*:*:*:*:*:python:*:* Versions before 0.0.16 Vulnerable ·badkeys

Remediation

  • Fix · CNA badkeys (badkeys) Fixed in 0.0.16
  • Fix · GHSA-wjpc-4f29-83h3 badkeys (PyPI) Fixed in 0.0.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21439
  2. 2026-10-03 Alias added: GHSA-wjpc-4f29-83h3

References

Exploit 1

Patch 2

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences