ZeroDay Findings
Sign inSign up

Findings

CVE-2023-51385

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token…

Published Dec 18, 2023 · updated Oct 15, 2026 · openbsd openssh

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 18, 2023 · NIST NVD

    Detected

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

  2. Oct 15, 2026 · NIST NVD

    Updated

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux12.0
  • cpe openbsd/opensshversion unspecified

Sources

  • CVE.orgCVE-2023-51385

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2023-51385

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in

    nvd.nist.gov

References