Is asyncssh safe ? 8 known vulnerabilities, worst severity CRITICAL.
// reach 9 direct dependencies
3 carry known advisories, worst HIGH
23 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 78th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-97cv-6pjf-5f9q, the advisory selected below
// 8 advisories GHSA-97cv-6pjf-5f9q The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step. CRIT GHSA-2wxc-x7rj-hg8f | | | HIGH GHSA-c35q-ffpf-5qpm An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation. HIGH GHSA-rw4j-r22c-9gc3 A malicious SSH server can wedge an AsyncSSH client, and an authenticated MODE GHSA-qr67-gv47-xwwh Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h). The MODE GHSA-g794-3fmp-753h AsyncSSH 2.22.0 expands the OpenSSH-compatible AuthorizedKeysFile %u token with the raw SSH username during pre-authentication server config reload. A server configured with a documented per-user key pattern such as AuthorizedKeysFile authorized_keys/%u can be made to read an authorized-keys file outside the intended directory when the SSH username contains path traversal segments. If the attacker MODE GHSA-hfmc-7525-mj55 AsyncSSH v2.14.1 and earlier is vulnerable to a novel prefix truncation attack (a.k.a. Terrapin attack), which allows a man-in-the-middle attacker to strip an arbitrary number of messages right after the initial key exchange, breaking SSH extension negotiation (RFC8308) in the process and thus downgrading connection security. MODE GHSA-cfc2-wr2v-gxm5 An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack. MODE The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 22:03 UTC. The most recent advisory here was published 2026-09-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page