CVE-2025-61985 Command injection in OpenSSH
OpenSSH allows null characters in ssh URIs, enabling code execution via ProxyCommand when specific configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61985?
CVE-2025-61985 is a low-severity command injection vulnerability in OpenBSD OpenSSH, published on 6 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
Weakness: CWE-158
Which versions are affected by CVE-2025-61985?
How do I fix CVE-2025-61985?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-61985 being exploited?
There is no known exploitation of CVE-2025-61985 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-61985, AZL-68228, AZL-68292, BELL-CVE-2025-61985, CLSA-2026-1767627264, CLSA-2026-1767627533 and 6 more.