This vulnerability in bosh-cli versions before 7.10.4 allows an attacker controlling a BOSH Director to perform argument injection by inserting arbitrary OpenSSH options into the ssh command executed locally by the operator. The flaw affects commands such as 'bosh ssh -c' and 'bosh logs -f' that spawn non-interactive SSH sessions. Exploitation results in local command execution on the operator's machine, posing a significant risk to the operator's environment.

Successful exploitation enables an attacker with control over the BOSH Director to execute arbitrary commands locally on the operator's workstation by injecting malicious SSH options. This compromises the operator's system integrity and confidentiality, potentially leading to further system compromise or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should upgrade bosh-cli to version 7.10.4 or later once available. Until then, avoid running non-interactive SSH commands through bosh-cli with untrusted BOSH Directors.