From 56ce3c193eb06af5bf3b07ec0b4c7308b5c72130 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Thu, 2 Apr 2026 15:39:25 +0200
Subject: [PATCH] CVE-2026-59846 Block shell metacharacters from
 usernames
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When an attacker could sneak the dollar sign or backslash into the username
expanded for example in proxy command, it can result in printing environment
variables that might contain secrets.

This is a fixup of CVE-2023-6004 which fixed this for hostnames, but these
two metacharacters were left out from the username filter.

This keeps the list in one place to simplify maintenance.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
(cherry picked from commit 6309df220e3431deb41946f892f4bb5af8b59dba)

diff --git a/include/libssh/priv.h b/include/libssh/priv.h
index 62069970..9b8e2547 100644
--- a/include/libssh/priv.h
+++ b/include/libssh/priv.h
@@ -245,6 +245,8 @@ int ssh_gettimeofday(struct timeval *__p, void *__t);
 # define LIBSSH_MEM_PROTECTION
 #endif
 
+#define SSH_DANGEROUS_SHELL_CHARS "'`\";&<>|(){}$\\,"
+
 /* forward declarations */
 struct ssh_common_struct;
 struct ssh_kex_struct;
diff --git a/src/misc.c b/src/misc.c
index d5883cb3..7528902e 100644
--- a/src/misc.c
+++ b/src/misc.c
@@ -2192,7 +2192,7 @@ int ssh_check_username_syntax(const char *username)
 
     username_len = strlen(username);
     if (username_len == 0 || username[username_len - 1] == '\\' ||
-        strpbrk(username, "'`\";&<>|(){}") != NULL) {
+        strpbrk(username, SSH_DANGEROUS_SHELL_CHARS) != NULL) {
         return SSH_ERROR;
     }
     for (size_t i = 0; i < username_len; i++) {
-- 
2.54.0