CVE-2025-61984

CVE-2025-61984 is a command injection vulnerability in OpenSSH that allows for remote code execution on a client system. The vulnerability stems from the inadequate filtering of control characters in usernames when the ProxyCommand string is expanded. This occurs when the %r token is used in the ProxyCommand directive within the user's SSH configuration file (~/.ssh/config) to include the remote username. An attacker can inject control characters, such as newline characters, into the username, which can then interrupt the intended `exec` invocation. This interruption allows the attacker to execute arbitrary commands with the privileges of the SSH client. A common attack scenario involves a malicious Git submodule URL. If a user clones a repository with a crafted .gitmodules entry and a matching SSH proxy configuration, the injected control characters trigger the proxy command to execute arbitrary scripts before the SSH connection is established. This vulnerability affects OpenSSH client versions up to and including 10.0p1.