CVE-2023-51385

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2023-12-18

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• openbsd:openssh

References

• http://seclists.org/fulldisclosure/2024/Mar/21
• http://www.openwall.com/lists/oss-security/2023/12/26/4
• https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
• https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
• https://security.gentoo.org/glsa/202312-17

Check your stackJSON