EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in AsyncSSH, a Python library implementing asynchronous SSHv2 client and server functionality. The issues include an incomplete patch for a previous AuthorizedKeysFile path traversal flaw and a separate SCP client path traversal vulnerability. The first vulnerability allows an attacker-controlled SSH username containing expansion characters such as ~ or ${ENV} to bypass filename restrictions and redirect authorized key lookups outside the intended directory, potentially enabling unauthorized key-based authentication. The second vulnerability allows a malicious SSH server to provide crafted SCP filenames containing ../ traversal sequences, causing the AsyncSSH SCP client to write files outside the intended destination directory, potentially overwriting sensitive files and leading to code execution.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities have been identified in AsyncSSH, a Python library implementing asynchronous SSHv2 client and server functionality. The issues include an incomplete patch for a previous AuthorizedKeysFile path traversal flaw and a separate SCP client path traversal vulnerability. The first vulnerability allows an attacker-controlled SSH username containing expansion characters such as ~ or ${ENV} to bypass filename restrictions and redirect authorized key lookups outside the intended directory, potentially enabling unauthorized key-based authentication. The second vulnerability allows a malicious SSH server to provide crafted SCP filenames containing ../ traversal sequences, causing the AsyncSSH SCP client to write files outside the intended destination directory, potentially overwriting sensitive files and leading to code execution.[emaillocker id="1283"]
CVE-2026-54590 (CVSS 5.9 — Medium): AsyncSSH vulnerability caused by an incomplete path traversal fix, allowing attackers to bypass AuthorizedKeysFile username sanitization using ~ or ${ENV} expansion, potentially redirecting authorized key lookups outside the intended directory and enabling unauthorized SSH authentication.
CVE-2026-54591 (CVSS 8.1 — High): AsyncSSH vulnerability allows a malicious SSH server to perform arbitrary file writes on an SCP client by exploiting unsanitized filenames containing ../ path traversal sequences, enabling overwriting sensitive files such as .bashrc, .ssh/rc, or authorized_keys and potentially achieving code execution.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-qr67-gv47-xwwh
https://github.com/advisories/GHSA-2wxc-x7rj-hg8f