In OpenSSH versions prior to 10.3, a flaw allows shell metacharacters included in a user name supplied on the command line to be interpreted as executable commands. This vulnerability permits an attacker to run arbitrary system commands during an SSH session, effectively compromising the host’s confidentiality, integrity, and availability. The weakness aligns with CWE‑696, indicating improper handling of user-supplied input leading to command injection.

The vulnerability affects the OpenBSD OpenSSH implementation, specifically all releases before 10.3. Users who run pre‑10.3 binaries and provide untrusted user names in command‑line contexts with non‑default settings in ssh_config are at risk.

The CVSS score of 3.6 signals a low severity level, but the necessity for an untrusted username and altered % settings in ssh_config makes exploitation less likely. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote via SSH, though the requirement for non‑default configuration suggests that real‑world exploitation would be constrained unless administrators have permissive settings.