Most recent entries from all

BREW-dvc-CVE-2026-54590 — asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a le…

Affected: Homebrew: dvc

**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The 2.23.0 guard that sanitises the SSH username before `%u` substitution in `AuthorizedKeysFile` blocks `/`, `\` and `..`, but does not block a leading `~` (or `${ENV}`), both of which are re-introduced by later expansion and reach the file open — defeating the guard.

**Affected:** asyncssh 2.23.0 and current `develop` (commit `a60f863`, HEAD on 2026-05-29).

## Summary The fix for CVE-2026-45309 added a guard in `SSHServerConfig._set_tokens` (`asyncssh/config.py:715-716`) that rejects an SSH username containing `/`, `\`, or equal to `..`, before it is substituted for the `%u` token in `AuthorizedKeysFile`:

if self._user == '..' or '/' in self._user or '\\' in self._user: raise IllegalUserName('Unsafe username substitution')

However, the `%u`-substituted value is subsequently passed through environment-variable expansion (`_expand_val`, `config.py:145-149` — token expansion then env expansion) and, at file-open time, through `expanduser()` (`read_authorized_keys` → `read_file` → `open(Path(filename).expanduser())`, `auth_keys.py:348` → `misc.py:290`). Both re-introduce the path control the guard was meant to remove, so a username that contains no `/`/`\` can still cause the server to read an authorized-keys file outside the intended per-user directory.

The client-supplied username reaches this path pre-authentication: `_process_userauth_request` takes…

CVE-2026-54590 — AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

Affected: ronf asyncssh

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

GHSA-qr67-gv47-xwwh — asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a le…

Affected: PyPI: asyncssh

**Affected:** asyncssh 2.23.0 and current `develop` (commit `a60f863`, HEAD on 2026-05-29).

if self._user == '..' or '/' in self._user or '\\' in self._user: raise IllegalUserName('Unsafe username substitution')

The client-supplied username reaches this path pre-authentication: `_process_userauth_request` takes…