CVE-2026-54590
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
AsyncSSH version 2.23.0 contains an incomplete fix for CVE-2026-45309 that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.
Risk Assessment
An attacker could exploit this vulnerability to escalate privileges or gain unauthorized SSH access by bypassing the authorized-keys file path restrictions.
Recommendation
Immediately upgrade the AsyncSSH library to version 2.23.1 or later.
Other vulnerabilities in AsyncSSH
See all- CVE-2026-45309High
Vulnerability in AsyncSSH before version 2.23.0 allows an attacker to exploit the %u token expansion in AuthorizedKeysFile to read key files outside the intended directory using path traversal segments (/, \, ..). The attacker can authenticate using a chosen key file.
- CVE-2026-54591High
A vulnerability in AsyncSSH prior to version 2.23.1 allows a malicious SSH server to write arbitrary files on the SCP client's filesystem. This occurs because _parse_cd_args in scp.py returns server-provided filenames verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary, enabling ../ traversal sequences.
Original NVD description (English source)
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.