CVE-2025-61984: 
OpenSSH vulnerability analysis and mitigation

CVE-2025-61984 affects OpenSSH versions before 10.1, discovered on October 6, 2025. The vulnerability allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources include the command line and %-sequence expansion of a configuration file (NVD, OpenSSH Release).

The vulnerability stems from inadequate filtering of control characters in usernames when expanding the ProxyCommand string. When using the %r token to include the remote username, control characters such as newline are not stripped, allowing an attacker to inject line breaks that interrupt the exec invocation and execute arbitrary commands on the client side. The vulnerability has been assigned a CVSS 3.1 Base Score of 3.6 (Low) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N (GBHackers, NVD).

The vulnerability can result in remote code execution under specific conditions. However, the impact is considered low to moderate as it requires particular configurations and the attacker having prior knowledge of the hostnames used in match conditions. The vulnerability is particularly concerning for environments using SSH proxies, including cloud gateway solutions like Teleport, which generate proxy commands containing %r (SSH Blog).

The primary mitigation is to upgrade to OpenSSH version 10.1 or later, which disallows control characters in usernames. For those unable to upgrade immediately, it is possible to mitigate through SSH configuration by quoting any ProxyCommand that passes the %r expansion token with single quotes. Additional defense-in-depth measures include configuring git to turn off SSH transports for submodules using 'git config --global protocol.ssh.allow user' and disabling URL handlers for ssh:// (SSH Blog, OpenSSH Release).

The vulnerability is considered minor by OpenSSH developers, as stated in Ubuntu's security advisory. The security community has noted that while the vulnerability has unique exploitation conditions, it highlights important considerations for software supply chain security and the interactions between git, SSH, and shell behavior (Ubuntu CVE).