CVE-2026-59846: Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh username handling for ProxyCommand expansion. The sshcheckusernamesyntax() validation path in src/misc.c used an incomplete dangerous-character filter for usernames expanded through %r. As a result, specially crafted usernames containing shell-significant characters could reach shell-evaluated ProxyCommand handling and influence shell expansion, exposing environment variables and causing unintended shell behavior. This issue affects clients that combine untrusted username input with ProxyCommand-style shell execution.
Other sources
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
— MITRE