Command injection in OpenSSH - #VU158342
Published: October 28, 2026
Vulnerability identifier: #VU158342
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands with the privileges of the user running the SSH client.
The vulnerability exists due to improper neutralization of shell metacharacters in ssh when an untrusted command-line username containing '$' or '' is used in a shell context such as ProxyCommand or Match exec. A remote attacker can supply a crafted username that the victim uses on the command line to inject shell commands.
Affected software
OpenSSH
Remediation
Install security update from vendor's website.
OpenSSH - update to 10.6p1