Bash a Newline: The SSH ProxyCommand RCE You Didn't Know You Had

A vulnerability exists in OpenSSH versions prior to 10.1 where the `ssh` client fails to properly sanitize control characters within usernames originating from untrusted sources, such as the command line or configuration file expansions. When a user has a specific `ProxyCommand` configured with the remote username token (`%r`), an attacker can craft a malicious username containing shell metacharacters (like newlines) and a syntax error. This combination tricks certain shells (like Bash) into executing arbitrary commands on the client's machine, leading to remote code execution. The attack is typically delivered via social engineering, for example, by convincing a developer to clone a malicious Git repository with a crafted submodule URL.