CVE-2026-54590

Medium

Description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

SeverityMedium

CVSS5.9

Exploit probability—

ProductAsyncssh

PublishedJul 8, 2026

First seenJul 8, 2026

Weakness typeCWE-22Path traversal CWE-639Authorization bypass through user-controlled key

How to fix

Update

asyncssh2.23.1 or later

Affected products

Product	Affected versions	Fixed in
asyncsshPyPI	v < 2.23.1	2.23.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.