CVE-2026-21439
Medium · 4.0badkeys vulnerable to ASCII control character injection on console via malformed input
CVSS
4.0
EPSS
0.3%
Published
Jan 5, 2026
CISA due date
—
The record
An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | badkeys | 0 | 0.0.16 |
Related vulnerabilities
- GHSA-wjpc-4f29-83h3 badkeys vulnerable to ASCII control character injection on console via malformed input Same vulnerability
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
- CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
- CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
- CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
- CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
- CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150
- CVE-2026-64654 GitHub CLI (gh) is GitHub's official command line tool. CWE-150