ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 6, 2025 · NIST NVD

   Detected

   ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

2. Oct 15, 2026 · NIST NVD

   Updated

   ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

Sources

• CVE.orgVulnerability recordCVE-2025-61984

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-61984

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2025-61984

  ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file

  nvd.nist.gov

References

• Reference · openwall.com
• Reference · openwall.com
• Reference · cert-portal.siemens.com
• Reference · marc.info
• Reference · openssh.com
• Reference · openwall.com
• Reference · vicarius.io
• Reference · vicarius.io