OpenSSH ProxyCommand Flaw Allows Remote Code Execution – PoC Released

Security researchers have disclosed a critical OpenSSH flaw in ProxyCommand that can enable remote code execution on client systems, tracked as CVE-2025-61984, with the vulnerability detailed by the NVD. The flaw arises from inadequate filtering of control characters in usernames when expanding the ProxyCommand string, allowing newline injections that interrupt the exec invocation and permit arbitrary commands to run on the client side.

A proof-of-concept exploit demonstrating the issue in Bash, as well as in other shells, has been published, and the exploit shows how injecting particular patterns can trigger a syntax error that the attacker’s payload can ride through. OpenSSH ≤ 10.0p1 is affected, with a high CVSS score of 8.1, and the risk is relevant to environments using SSH proxies and complex proxy configurations.

Mitigations include upgrading to OpenSSH version 10.1p1 or later, or quoting the %r token in SSH client configurations as a temporary defence, for example ProxyCommand /usr/bin/nc -X connect -x proxy:8080 '%r@%h:%p'.