AsyncSSH vulnerabilities
3 known CVE vulnerabilities in AsyncSSH, translated and rated.
- CVE-2026-45309High
Vulnerability in AsyncSSH before version 2.23.0 allows an attacker to exploit the %u token expansion in AuthorizedKeysFile to read key files outside the intended directory using path traversal segments (/, \, ..). The attacker can authenticate using a chosen key file.
- CVE-2026-54591High
A vulnerability in AsyncSSH prior to version 2.23.1 allows a malicious SSH server to write arbitrary files on the SCP client's filesystem. This occurs because _parse_cd_args in scp.py returns server-provided filenames verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary, enabling ../ traversal sequences.
- CVE-2026-54590Medium
AsyncSSH version 2.23.0 contains an incomplete fix for CVE-2026-45309 that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.