===========================================================
== Subject:     Potential credential leak through ProxyCommand
==
== CVE ID#:     CVE-2026-59846
==
== Versions:    libssh < 0.12.1; < 0.11.5
==
== Summary:     Malicious username expanded in the ProxyCommand could
==              lead to unintended behavior in the shell.
==
== Component:   client only
==
===========================================================

===========
Description
===========

This is a variant of CVE-2023-6004, which fixed a similar issue for
hostnames. When an attacker could force a user to connect to a host
with a ProxyCommand containing the %r expansion with malicious username, 
it could result in leaking environment variables.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)

==========
Workaround
==========

Make sure you are not executing connections with untrusted username
inputs.

=======
Credits
=======

Originally reported by Saransh Rana.
Independently reported by Mikhail Ilin.
Patches provided by Jakub Jelen of the libssh team.

==========================================================
== The libssh team
==========================================================