CVE-2025-61984

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

• CWE-159

• https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2
• https://www.openssh.com/releasenotes.html#10.1p1
• https://www.openwall.com/lists/oss-security/2025/10/06/1
• http://www.openwall.com/lists/oss-security/2025/10/07/1
• http://www.openwall.com/lists/oss-security/2025/10/12/1
• https://www.vicarius.io/vsociety/posts/cve-2025-61984-detection-script-remote-code-execution-vulnerability-affecting-openssh
• https://www.vicarius.io/vsociety/posts/cve-2025-61984-mitigation-script-remote-code-execution-vulnerability-affecting-openssh
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984

Published

Oct 6, 2025

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61976CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with im…8.7
• CVE-2025-61977A weak password recovery mechanism for forgotten password vu…7.3
• CVE-2025-61979An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-6198There is a vulnerability in the Supermicro BMC firmware vali…7.2
• CVE-2025-61982An arbitrary code execution vulnerability exists in the Code…7.8
• CVE-2025-61983Heap-based Buffer Overflow vulnerability in TP-Link Archer A…8
• CVE-2025-61985ssh in OpenSSH before 10.1 allows the '\0' character in an s…3.6
• CVE-2025-61987GroupSession Free edition prior to ver5.3.0, GroupSession by…6.9
• CVE-2025-6199A flaw was found in the GIF parser of GdkPixbuf’s LZW decode…3.3
• CVE-2025-61990When using a multi-bladed platform with more than one blade,…8.7
• CVE-2025-61994Cross-site scripting vulnerability exists in GROWI prior to …5.4
• CVE-2025-61996OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8