A critical vulnerability (CVE-2025-61984) in OpenSSH’s ProxyCommand feature allows remote attackers to execute arbitrary code on client systems by exploiting inadequate filtering of control characters in usernames. The flaw arises when the `%r` token in `~/.ssh/config` expands malicious usernames containing newline injections, causing unintended command execution with the SSH client’s privileges. Proof-of-concept exploits demonstrate attacks via crafted Git submodule URLs, where a malicious repository’s `.gitmodules` entry triggers the vulnerability if the user’s SSH config uses `ProxyCommand` with `%r`.The issue affects OpenSSH clients ≤ 10.0p1, posing severe risks to organizations relying on SSH proxies, including cloud gateways like Teleport. While the flaw requires specific prerequisites (e.g., unquoted `%r` in config), its exploitation could lead to full system compromise, data theft, or lateral movement within networks. Mitigations include upgrading to OpenSSH 10.1p1+, quoting the `%r` token, or restricting SSH transport in Git. The vulnerability’s CVSS 3.1 score of 8.1 underscores its high severity, particularly for enterprises with exposed SSH proxy configurations.