Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-61984

Good to know:

icon
icon

Date: October 5, 2025

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-61984
https://www.openssh.com/releasenotes.html#10.1p1
https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2
https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984
https://www.openwall.com/lists/oss-security/2025/10/06/1
https://www.mend.io/vulnerability-database/CVE-2025-61984

Severity Score

Weakness Type (CWE)

Improper Handling of Invalid Use of Special Elements

CWE-159

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/openssh/openssh-portable.git - V_10_1_P1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us