291 matches found
PYSEC-2026-3809 asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...
pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2026-54591 via asyncssh (1.11.0)
asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2026-54591 Source advisory: OSV:PYSEC-2026-3808...
pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2026-54590 via asyncssh (1.11.1)
asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...
asyncssh has SCP Path Traversal to Arbitrary File Write
| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...
pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2026-54591 via asyncssh (1.11.1)
asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2026-54591 Source advisory: OSV:GHSA-2WXC-X7RJ-HG8F...
GHSA-2WXC-X7RJ-HG8F asyncssh has SCP Path Traversal to Arbitrary File Write
| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...
pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2026-54591 via asyncssh (1.10.0)
asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2026-54591 Source advisory: OSV:GHSA-2WXC-X7RJ-HG8F...
pyplanet (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-54591 via asyncssh (1.9.0)
asyncssh PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.0.1, =0.1.4 Source cves: CVE-2026-54591 Source advisory: OSV:GHSA-2WXC-X7RJ-HG8F...
aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +77 more potentially affected by CVE-2026-54591 via asyncssh (>=2.0.1, <=2.22.0)
asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =0.3.0, =0.6.5 and more Source cves: CVE-2026-54591 Source advisory: OSV:GHSA-2WXC-X7RJ-HG8F...
netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2026-54591 via asyncssh (1.18.0)
asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2026-54591 Source advisory: OSV:GHSA-2WXC-X7RJ-HG8F...
pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2026-54590 via asyncssh (1.10.1)
asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
pyplanet (>=0.5.3, <=0.5.4) potentially affected by CVE-2026-54590 via asyncssh (1.11.1)
asyncssh PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.3, =0.5.4 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
aioasuswrt (>=1.1.20, <=1.1.21) potentially affected by CVE-2026-54590 via asyncssh (1.15.0)
asyncssh PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aioasuswrt =1.1.20, =1.1.21 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +77 more potentially affected by CVE-2026-45309 +1 more via asyncssh (>=2.0.1, <=2.22.0)
asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =0.3.0, =0.6.5 and more Source cves: CVE-2026-45309, CVE-2026-54590 Source advisory: GHSA-QR67-GV47-XWWH...
aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +77 more potentially affected by CVE-2026-54590 via asyncssh (>=2.0.1, <=2.22.0)
asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =0.3.0, =0.6.5 and more Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-54590 via asyncssh (1.16.1)
asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2026-54590 via asyncssh (1.18.0)
asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2026-54590 via asyncssh (1.11.0)
asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...