The NetBird SSH configuration manager constructs system‑wide SSH drop‑in files that place each peer endpoint inside a double‑quoted Match host directive without escaping. This represents an improper neutralization of special elements (CWE-116) and allows OS command injection (CWE-78). If an attacker controls a peer name and embeds a double quote, the quoted context is broken and arbitrary SSH directives, including exec commands, can be injected. These commands run locally as the user next time SSH is executed, enabling privilege‑escalating or arbitrary code execution on the client host.

Desktop NetBird clients between versions 0.60.0 and 0.74.6 on Linux, macOS, Windows and FreeBSD are affected; Android and iOS applications are not.

The CVSS score of 8.9 indicates a high severity vulnerability. The EPSS score of less than 1% implies a very low likelihood of exploitation at any given moment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the need for a malicious or compromised peer to supply a crafted peer name to the client. Once the drop‑in file is regenerated, any subsequent local SSH invocation will execute the injected commands with the privileges of the user running SSH.