CVE-2023-51385: Debian Linux

Medium severity, CVSS 6.5. EPSS: 19.8% chance of exploitation in the next 30 days.

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only; version 12.0 only
• OpenBSD OpenSSH: before 9.6 (fixed in 9.6)

Published 2023-12-18. Last modified 2026-06-17.