Is CVE-2026-54591 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54591 being exploited in the wild.

How severe is CVE-2026-54591?

High severity, with a CVSS score of 8.1, published 8 July 2026.

Which products and versions are affected?

asyncssh (PyPI) ECOSYSTEM:introduced=0,fixed=2.23.1.

Is there a fix for CVE-2026-54591?

Yes. asyncssh (PyPI): upgrade to 2.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54591 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54591?

Check whether you run asyncssh (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54591: AsyncSSH path traversal in SCP client

CVE-2026-54591 · Severity: high · CVSS 8.1 · Published 2026-07-08

AsyncSSH is a Python SSH library widely used for secure remote file transfer via SCP. A malicious SSH server can exploit the SCP client to write arbitrary files anywhere on the user's filesystem by sending specially crafted directory traversal sequences (e.g., `../`). This can lead to remote code execution by overwriting shell configuration files like `~/.bashrc` or SSH authorization files, allowing attackers to execute code when the user next logs in or opens a terminal.

Technologies: asyncssh (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54591 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54591 being exploited in the wild.
How severe is CVE-2026-54591?: High severity, with a CVSS score of 8.1, published 8 July 2026.
Which products and versions are affected?: asyncssh (PyPI) ECOSYSTEM:introduced=0,fixed=2.23.1.
Is there a fix for CVE-2026-54591?: Yes. asyncssh (PyPI): upgrade to 2.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54591 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54591?: Check whether you run asyncssh (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

asyncssh (PyPI): upgrade to 2.23.1 or later
```
pip install "asyncssh>=2.23.1"
```

Technical details

This is a path traversal (CWE-22) vulnerability in AsyncSSH's SCP receive implementation. The vulnerability exists in the `_parse_cd_args()` function (scp.py:134-142) and `_recv_files()` function (scp.py:706-713), which fail to sanitize server-supplied filenames before joining them with the target directory path using `posixpath.join()`. An attacker controlling a malicious SSH server can send SCP protocol messages with filenames containing `../` sequences to escape the intended download directory. By chaining directory traversal commands via the SCP `D` (directory) action, an attacker can overwrite critical files such as `~/.bashrc`, `~/.profile`, `~/.ssh/rc`, or `~/.ssh/authorized_keys`. The vulnerability requires user interaction (the application must call `asyncssh.scp()` to download from an attacker-controlled server) and network connectivity, but no authentication or special privileges. Remote code execution is achievable when the user's next login/terminal session sources the modified files. This is the same vulnerability class as CVE-2019-6111 in OpenSSH. A patch is available in AsyncSSH version 2.23.1 and later.

Affected products

ronf asyncssh <= 2.23.0

Identifiers

CVE-2026-54591
GHSA-2wxc-x7rj-hg8f
PYSEC-2026-3808

Timeline

2026-06-16: disclosed
2026-06-16: patched: AsyncSSH 2.23.1 released
2026-08-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.