CVE-2026-21439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21439", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T03:00:29.275Z", "datePublished": "2026-01-05T23:51:35.670Z", "dateUpdated": "2026-01-06T19:01:48.962Z"}, "containers": {"cna": {"title": "badkeys vulnerable to ASCII control character injection on console via malformed input", "problemTypes": [{"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3"}, {"name": "https://github.com/badkeys/badkeys/issues/40", "tags": ["x_refsource_MISC"], "url": "https://github.com/badkeys/badkeys/issues/40"}, {"name": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a", "tags": ["x_refsource_MISC"], "url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a"}, {"name": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087", "tags": ["x_refsource_MISC"], "url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087"}], "affected": [{"vendor": "badkeys", "product": "badkeys", "versions": [{"version": "< 0.0.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-05T23:51:35.670Z"}, "descriptions": [{"lang": "en", "value": "badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16."}], "source": {"advisory": "GHSA-wjpc-4f29-83h3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/badkeys/badkeys/issues/40", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:24:28.663559Z", "id": "CVE-2026-21439", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T19:01:48.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21439", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:24:28.663559Z"}}}], "references": [{"url": "https://github.com/badkeys/badkeys/issues/40", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:24:31.956Z"}}], "cna": {"title": "badkeys vulnerable to ASCII control character injection on console via malformed input", "source": {"advisory": "GHSA-wjpc-4f29-83h3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "badkeys", "product": "badkeys", "versions": [{"status": "affected", "version": "< 0.0.16"}]}], "references": [{"url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3", "name": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/badkeys/badkeys/issues/40", "name": "https://github.com/badkeys/badkeys/issues/40", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a", "name": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087", "name": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-05T23:51:35.670Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21439", "state": "PUBLISHED", "dateUpdated": "2026-01-06T19:01:48.962Z", "dateReserved": "2025-12-29T03:00:29.275Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-05T23:51:35.670Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "badkeys", "vendor": "badkeys", "versions": [{"status": "affected", "version": "< 0.0.16"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:badkeys:badkeys:*:*:*:*:*:python:*:*", "matchCriteriaId": "AA459E08-D598-4832-942C-FF493A471141", "versionEndExcluding": "0.0.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16."}, {"lang": "es", "value": "badkeys es una herramienta y biblioteca para verificar claves p\u00fablicas criptogr\u00e1ficas en busca de vulnerabilidades conocidas. En las versiones 0.0.15 e inferiores, un atacante podr\u00eda inyectar contenido con caracteres de control ASCII como tabulaciones verticales, secuencias de escape ANSI, etc., que pueden generar una salida enga\u00f1osa de la herramienta de l\u00ednea de comandos badkeys. Esto afecta el escaneo de claves DKIM (tanto --dkim como --dkim-dns), claves SSH (modo --ssh-lines), y nombres de archivo en varios modos. Este problema est\u00e1 solucionado en la versi\u00f3n 0.0.16."}], "id": "CVE-2026-21439", "lastModified": "2026-06-17T10:18:40.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21439", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:24:28.663559Z", "version": "2.0.3"}}]}, "published": "2026-01-06T00:15:49.027", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/badkeys/badkeys/issues/40"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/badkeys/badkeys/issues/40"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T08:17:29.298346+00:00", "value": {"mitigation_remediation": ["Upgrade badkeys to version 0.0.16 or later.", "Sanitize console output by filtering ASCII control characters before display.", "Validate input to reject or escape ASCII control characters during key scanning."], "summary": {"action": "Upgrade", "impact": "Misinformation via console output"}, "threat_synthesis": {"affected_systems": "Versions 0.0.15 and earlier of the badkeys tool, distributed for all operating systems as a Python package, are affected. The issue appears in command\u2011line modes that output key information, including DKIM (--dkim, --dkim-dns), SSH (--ssh-lines), and filename analyses. The fix is implemented in 0.0.16 and later.", "description_and_impact": "The vulnerability arises because badkeys does not filter ASCII control characters in its console output, allowing an attacker to supply input containing such characters which may be interpreted by the terminal as formatting or command sequences, resulting in misleading output that can cause users to incorrectly assess key validity. This manifests as false positives or negatives during DKIM or SSH key scans, potentially misleading administrators. The weakness is classified as CWE\u2011150 because the program fails to properly validate or sanitize user-supplied strings before displaying them.", "risk_and_exploitability": "The CVSS score of 2 indicates low severity, and the EPSS score of less than 1% suggests a very low exploitation probability. Since the flaw is limited to console output and does not grant code execution or network access, the threat is largely restricted to the local user or administrator executing badkeys. The vulnerability does not appear in the CISA KEV catalog, further indicating its low impact on widespread exploit campaigns. The best attack scenario would involve an attacker supplying specially crafted input to an unsuspecting user, potentially misleading them into trusting or ignoring a key. This risk is mitigated by applying the available patch."}}}}, "created": "2026-04-18T08:30:35.819544+00:00", "updated": "2026-04-18T08:30:35.819561+00:00", "vendors": []}