MEDIUM 5.9 GitHub
CVE-2026-54590
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username
**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The
2.23.0 guard that sanitises the SSH username before `%u` substitution
in `AuthorizedKeysFile` blocks `/`, `\` and `..`, but does not block a
leading `~` (or `${ENV}`), both of which are re-introduced by later
expansion and reach the file open — defeating the guard.
**Affected:** asyncssh 2.23.0 and current `develop` (commit `a60f863`,
HEAD on 2026-05-29).
## Summary
The fix for CVE-2026-45309 added a guard in
`S
Affected Products
- pip/asyncssh <= 2.23.0
References
- https://github.com/advisories/GHSA-qr67-gv47-xwwh
- https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-54590
- https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-08-26 via GitHub. Affected: pip/asyncssh <= 2.23.0.
vulnfeed aggregates 11364 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.