A new command injection vulnerability in OpenSSH could allow an attacker to achieve remote code execution on a victim's machine.
The vulnerability, codenamed CVE-2025-61984, is a bypass of a previous fix for a similar issue (CVE-2023-51385) and exploits the way the ProxyCommand interacts with the underlying system shell when handling specially crafted usernames.
The "heart" of the vulnerability lies in OpenSSH's failure to properly sanitize control characters (such as newlines) within usernames. An attacker could create a username that includes a newline character followed by a malicious command.
See also: Critical GoAnywhere vulnerability used for ransomware attacks
This username is passed to the shell via SSH's ProxyCommand. While OpenSSH filters out many dangerous shell metacharacters, it does not filter out characters that could cause syntax errors in some shells.
When a shell such as Bash, Fish, or csh processes ProxyCommand, the formatted syntax error on the first line causes the command to fail, but the shell does not exit. Instead, it proceeds to execute the command on the next line, which is the malicious payload provided by the attacker. This behavior effectively bypasses security measures intended to prevent command execution, opening the door for remote code execution.
OpenSSH Vulnerability: Git Submodule Attack
The most practical exploitation scenario for CVE-2025-61984 involves a malicious Git repository. An attacker can configure a submodule within their repository to use a URL containing the malicious, multi-line username.
If a victim clones this repository recursively (git clone –recursive), Git will attempt to connect via SSH to retrieve the submodel. This triggers the ProxyCommand vulnerability if the user has a specific configuration.
See also: Warning! Vulnerability in Zabbix Agent and Agent 2 for Windows
The exploit requires two conditions on the victim's machine: a shell that continues execution after a syntax error (such as Bash) and an SSH configuration file (~/.ssh/config) with a ProxyCommand that uses the %r token to include the remote username.
It is worth noting that the secure shell Zsh is not vulnerable to this technique as it terminates when handling such errors. Tools such as Teleport have been found to create SSH configurations that use this vulnerable pattern, potentially increasing the attack surface.
Protection
The OpenSSH project has released an update to version 10.1 that fully addresses this vulnerability, disallowing control characters in usernames. All users are strongly encouraged to upgrade to this version or later.
For systems that cannot be updated immediately, some other protection measures. Users can edit their SSH configurations to enclose the %r token in single quotes ('%r') within any ProxyCommand (this prevents the shell from interpreting the special characters).
See also: PoC exploit and details of Chrome RCE vulnerability released
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Another effective defense-in-depth method is to configure Git to restrict automatic use of SSH for submodules.
This vulnerability serves as a critical reminder of the complex security risks that can arise from interactions between trusted development tools.
