CVE-2025-61984 is a vulnerability in OpenSSH prior to version 10.1 where the ssh client allows control characters in usernames that come from untrusted sources such as the command line or %-sequence expansions in configuration files. This improper handling of special elements (CWE-159) can potentially lead to code execution when the ProxyCommand feature is used. Usernames specified as complete literals in configuration files are not considered untrusted sources and are not affected. The vulnerability has a CVSS v3.1 base score of 3.6, reflecting low severity with local attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

The vulnerability may allow an attacker with local access or the ability to influence the command line or configuration expansions to execute code via crafted usernames containing control characters when ProxyCommand is enabled. The impact is limited to confidentiality and integrity with no availability impact. The overall severity is low based on the CVSS score and required conditions.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the OpenBSD or OpenSSH vendor advisories for current remediation guidance. Until a fix is available, avoid using untrusted sources for usernames that could contain control characters, and exercise caution when using ProxyCommand with usernames derived from command line or %-sequence expansions.