The vulnerability allows a malicious user to execute arbitrary shell commands when the SSH client supplies an untrusted username that contains shell metacharacters and the server’s ssh_config has the percent character (% ) remapping enabled. OpenSSH processes the username in a way that causes the shell to interpret the metacharacters, leading to command execution. This can compromise system integrity and confidentiality if the attacker can construct a malicious username.

OpenBSD OpenSSH releases before 10.3 are affected. Any installation of OpenSSH prior to 10.3 that compiles from source or is distributed as a system package is vulnerable. Users running earlier OpenSSH versions cannot safely use untrusted usernames passed via the SSH command line without applying the patch.

The CVSS score of 3.6 indicates low severity under current scoring, and the EPSS score below 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply an untrusted username and have ssh_config configured with a non‑default % mapping, which limits the attack surface. However, if those conditions are met, command execution can be achieved, potentially allowing privilege escalation or data exfiltration.