{"uuid": "95274199-9242-450b-a94c-740991127fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54591", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtyqeofowg25", "content": "asyncssh 2.23.1 fixes CVE-2026-54591: the SCP receive path does not sanitize server-provided filenames, so a malicious SSH server can chain \"../\" through the D directory action and write outside the target directory. Same class as OpenSSH's CVE-2019-6111. #dev", "creation_timestamp": "2026-08-26T16:19:28.033476Z"}