OpenSSH Flaw (CVE-2025-61984) Allows Remote Code Execution via Usernames

OpenSSH CVE-2025-61984 is a vulnerability affecting OpenSSH before version 10.1, where control characters in usernames originating from untrusted sources could be mishandled by the ProxyCommand directive, potentially enabling command injection or remote code execution under certain configurations. Leadbeater’s disclosure explains that while OpenSSH filters many metacharacters, it does not disallow $ and [, enabling scenarios where the exec line can fail while continuing to execute additional injected commands.

The vulnerability arises when the username variable is passed to a ProxyCommand, since the constructed command is executed by the user’s shell, and certain shells interpret newline characters or malformed expressions in ways that can lead to unintended execution. The fix, included in OpenSSH 10.1, disallows all control characters in usernames via the iscntrl() check in ssh.c.

For users unable to upgrade, security guidance includes quoting username expansions in ProxyCommand lines, for example using single quotes, and disabling SSH-based submodules by default in Git, with a reminder to avoid untrusted inputs in ssh(1) command lines.