Backport of:

From 76685c9b09a66435cd2ad8373246adf1c53976d3 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 2 Apr 2026 07:50:55 +0000
Subject: [PATCH] upstream: move username validity check for usernames
 specified on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

the commandline to earlier in main(), specifically before some contexts where
a username with shell characters might be expanded by a %u directive in
ssh_config.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We continue to recommend against using untrusted input on
the SSH commandline. Mitigations like this are not 100%
guarantees of safety because we can't control every
combination of user shell and configuration where they are
used.

Reported by Florian Kohnhäuser

OpenBSD-Commit-ID: 25ef72223f5ccf1c38d307ae77c23c03f59acc55
---
 ssh.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/ssh.c
+++ b/ssh.c
@@ -1099,8 +1099,15 @@ main(int ac, char **av)
 	if (!host)
 		usage();
 
+	/*
+	 * Validate commandline-specified values that end up in %tokens
+	 * before they are used in config parsing.
+	 */
+	if (options.user != NULL && !ssh_valid_ruser(options.user))
+		fatal("remote username contains invalid characters");
 	if (!ssh_valid_hostname(host))
 		fatal("hostname contains invalid characters");
+
 	if (options.user != NULL && !ssh_valid_ruser(options.user))
 		fatal("remote username contains invalid characters");
 	host_arg = xstrdup(host);
