← Back

CVE-2025-61985

nvd nist
Published: Oct 6, 2025Modified: Jul 14, 2026Deferred

JSON object

Loading...
3.6
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 1.0 / Impact: 2.5
Source: MITRE (Secondary)

Description

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

Related CWEs

CWE-158
Improper Neutralization of Null Byte or NUL Character
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References (4)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.