---
id: CVE-2026-21439
aliases:
  - GHSA-wjpc-4f29-83h3
  - PYSEC-2026-1212
title: >-
  badkeys vulnerable to ASCII control character injection on console via
  malformed input
summary: >-
  badkeys vulnerable to ASCII control character injection on console via
  malformed input
severity: low
vendor: badkeys
product: badkeys
ecosystem: pip
affected:
  - badkeys < 0.0.16
patched:
  - badkeys 0.0.16
published: '2026-01-05'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wjpc-4f29-83h3'
references:
  - url: 'https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-21439'
  - url: 'https://github.com/badkeys/badkeys/issues/40'
  - url: >-
      https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a
  - url: >-
      https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
  - url: 'https://github.com/badkeys/badkeys'
tags:
  - osv
  - pip
epss: 0.00336
epssPercentile: 0.2432
ingestedAt: '2026-07-08T18:25:53.828Z'
---

## Overview

### Impact

An attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the `badkeys` command-line tool. This impacts scanning DKIM keys (both `--dkim` and `--dkim-dns`), SSH keys (`--ssh-lines` mode), and filenames in various modes.

### Patches

This has been fixed with the following commits:
https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a

All users should upgrade `badkeys` to version 0.0.16.

### Resources

https://github.com/badkeys/badkeys/issues/40

## Affected packages

- `badkeys < 0.0.16`

## Remediation

Upgrade to a patched release:

- `badkeys 0.0.16`