CVE Catalog
CVE-2026-59846
LowCVSS 3.9Exploitation Probability (EPSS)
Low risk0.12%
2th percentile - higher than 2% of all known CVEs
Summary
A flaw in libssh: a malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
Risk Assessment
An attacker could access environment variables or execute unauthorized commands on the system.
Recommendation
It is recommended to update libssh to a version that includes a fix for the metacharacter injection vulnerability.
Original NVD description (English source)
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.