id: PYSEC-2026-1212
published: "2026-07-07T16:03:14.719026Z"
modified: "2026-07-07T17:23:49.361145Z"
aliases:
- CVE-2026-21439
- GHSA-wjpc-4f29-83h3
summary: badkeys vulnerable to ASCII control character injection on console via malformed input
details: "### Impact\n\nAn attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.\n\n### Patches\n\nThis has been fixed with the following commits:\nhttps://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087\nhttps://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a\n\nAll users should upgrade `badkeys` to version 0.0.16.\n\n### Resources\n\nhttps://github.com/badkeys/badkeys/issues/40"
affected:
- package:
    name: badkeys
    ecosystem: PyPI
    purl: pkg:pypi/badkeys
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.0.16
  versions:
  - 0.0.1
  - 0.0.10
  - 0.0.11
  - 0.0.12
  - 0.0.13
  - 0.0.14
  - 0.0.15
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - 0.0.9
references:
- type: WEB
  url: https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-21439
- type: WEB
  url: https://github.com/badkeys/badkeys/issues/40
- type: WEB
  url: https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a
- type: WEB
  url: https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
- type: PACKAGE
  url: https://github.com/badkeys/badkeys
- type: PACKAGE
  url: https://pypi.org/project/badkeys
- type: ADVISORY
  url: https://github.com/advisories/GHSA-wjpc-4f29-83h3
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P