The vulnerability is caused by argument injection in the BOSH CLI, enabling an attacker who compromises the BOSH Director to inject arbitrary OpenSSH options into a locally spawned ssh process when an operator runs non-interactive SSH commands such as bosh ssh -c or bosh logs -f. This injection results in the operator's workstation executing local commands that were not intended by the operator, effectively allowing remote code execution on the workstation. The flaw is a classic input-validation weakness described by CWE-20 and a command-execution issue described by CWE-78.

CloudFoundry Foundation's BOSH CLI versions prior to 7.10.4 are affected. Operators using these releases should be aware that the CLI's handling of SSH options is insecure until they upgrade to 7.10.4 or later.

The CVSS score severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, which indicates no known active exploitation. The likely attack vector requires an attacker to first compromise the BOSH Director and then persuades or tricks an operator into running the vulnerable non-interactive SSH commands, thereby injecting malicious options into the local ssh process of the operator's machine.