CVE-2023-51385

CVE-2023-51385 is an OS command injection vulnerability in OpenSSH versions prior to 9.6, affecting Debian and OpenBSD distributions. It allows an attacker to execute arbitrary commands if a username or hostname containing shell metacharacters is referenced by an expansion token, such as in an untrusted Git repository's submodule. Rated Medium severity (CVSS 6.5), this vulnerability has a low attack complexity and could lead to partial confidentiality and integrity compromise. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of interest.