Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2026-21439badkeys vulnerable to ASCII control character injection on console via malformed input

Low 2.0

In plain English

A low-severity security flaw in badkeys from badkeys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	badkeys	0.0.16	GHSA-wjpc-4f29-83h3
PyPI	badkeys	0.0.16	PYSEC-2026-1212

Affected products (as reported)

Vendor	Product	Versions
badkeys	badkeys	< 0.0.16

Weakness: CWE-150 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3 x_refsource_CONFIRM
https://github.com/badkeys/badkeys/issues/40 x_refsource_MISC
https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a x_refsource_MISC
https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 x_refsource_MISC