CVE-2026-110925: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Hardened Images

CVE-2026-110925 describes a flaw in OpenSSH where usernames containing '$' or a non-trailing backslash are not properly sanitized when expanded via %u in ProxyCommand or Match exec configurations. This can cause these characters to be passed directly into the shell, which may lead to unintended command execution or injection. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level. No patch or remediation details are provided in the available data.

The vulnerability could allow an attacker to influence shell commands executed by ProxyCommand or Match exec by crafting usernames with special characters. This may lead to limited confidentiality and integrity impacts, as indicated by the CVSS vector (C:L/I:L/A:N). There is no indication of known exploits in the wild or of denial of service impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configurations that expand %u inside ProxyCommand or Match exec, or sanitize usernames to exclude '$' and non-trailing backslashes to reduce risk.