Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

OpenSSH ProxyCommand Flaw Allows Remote Code Execution – PoC Released

Security researchers have identified a critical vulnerability in OpenSSH’s ProxyCommand feature, allowing remote code execution on client systems.

NBy Nathan ColeOct 07, 20251 min read

Security researchers have identified a critical vulnerability in OpenSSH’s ProxyCommand feature, allowing remote code execution on client systems.

This vulnerability, tracked as CVE-2025-61984 , arises from insufficient filtering of control characters in usernames when expanding the ProxyCommand string. The flaw enables attackers to inject line breaks that can interrupt command execution, resulting in arbitrary code execution on the client side.

The issue is triggered when using the %r token in the ProxyCommand directive within the ~/.ssh/config file. Control characters, such as newlines, are not stripped, which allows execution of attacker-controlled commands.

Affected Products Impact Exploit Prerequisites CVSS 3.1 Score

OpenSSH ≤ 10.0p1 (client) Remote code execution User SSH config with ProxyCommand using %r 8.1 (High)

A proof of concept has been released, demonstrating exploitation in Bash, fish, and csh shells. In Bash, injecting $[*] within an exec invocation generates a syntax error, allowing subsequent commands to execute:

Security researchers have identified a critical vulnerability in OpenSSH’s ProxyCommand feature, allowing remote code execution on client systems.
Nathan Cole · Thehackingpost

bash -xc "$(printf 'exec $[*]\necho compromised')"

This prints “compromised” after the error. Similar behaviors are observed in fish and csh shells. Zsh is not affected due to its handling of parse errors.

A potential attack vector involves a malicious Git submodule URL using the %r expansion. Cloning a repository with a crafted .gitmodules entry and matching SSH proxy configuration can lead to arbitrary code execution.

To mitigate this vulnerability, it is recommended to upgrade OpenSSH to version 10.1p1 or later, which disallows control characters in usernames. For those unable to upgrade, quoting the %r token in SSH client configurations can prevent newline injection:

Advertisement

ProxyCommand /usr/bin/nc -X connect -x proxy:8080 '%r@%h:%p'

Additional measures include restricting SSH transport for Git submodules:

git config --global protocol.ssh.allow user

Raising awareness about this vulnerability is crucial for environments using SSH proxies, such as cloud gateway solutions. Proper filtering and version updates are essential to prevent remote code execution.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026