PYSEC-2026-1212
badkeys vulnerable to ASCII control character injection on console via malformed input
Quick fix
PYSEC-2026-1212 — badkeys: upgrade to the fixed version with the command below.
pip install --upgrade 'badkeys>=0.0.16'Details
### Impact
An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.
### Patches
This has been fixed with the following commits: https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a
All users should upgrade `badkeys` to version 0.0.16.
### Resources
https://github.com/badkeys/badkeys/issues/40
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-21439[ADVISORY]
- https://github.com/badkeys/badkeys/issues/40[WEB]
- https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a[WEB]
- https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087[WEB]
- https://github.com/badkeys/badkeys[PACKAGE]
- https://pypi.org/project/badkeys[PACKAGE]
- https://github.com/advisories/GHSA-wjpc-4f29-83h3[ADVISORY]