Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ssh -t exec path concatenates the command unquoted — GNU-style -c shells lose all but the first word

Open
  • Is something wrong?
#2,478 0 comments 1 reaction 0 assignees View on GitHub

@caomengxuan666 is already working on this.

Since Oct 24, 2026.

  • #889 by @caomengxuan666 — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
c
Domain
backend

Research direction

The bug is in the pty branch of contrib/win32/win32compat/w32-doexec.c, where the command is concatenated unquoted after the shell's -c. Study the non-pty branch just below it and how build_exec_command escapes quotes/backslashes, then mirror that escaping in the pty path. Repro with a Git Bash DefaultShell and ssh -tt host 'sleep 30'; done means multi-word commands run identically with and without -t, including commands containing embedded quotes.

Written by the indexing model from the issue text.

Description

"OpenSSH for Windows" version: 9.5p1 (in-box Optional Feature)

Server / Client OS: Windows 10 19045

What is failing

When a pty is allocated (ssh -t), do_exec_windows builds the shell
command line by plain concatenation in contrib/win32/win32compat/w32-doexec.c:

// pty path
strcpy_s(pty_cmd, len, shell);                       // "\"<shell path>\""
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, shell_command_option_local);  // "-c"
strcat_s(pty_cmd, len, " ");
strcat_s(pty_cmd, len, command);                     // NOT quoted

This produces "C:\shell.exe" -c echo a b. Any shell whose -c takes a
single operand (GNU semantics — bash, and other bash-compatible shells)
then runs echo with a b demoted to $0/$1: the command silently
truncates to its first word.

The non-pty path immediately below does quote:

sprintf_s(posix_cmd_input, len, "%s %s \"%s\"", shell, option, exec_command);

Repro

Set a GNU-style shell as DefaultShell (e.g. Git Bash bash.exe or
Niubash niu.exe) with DefaultShellCommandOption = -c, then:

ssh -tt host 'whoami'          → works (single word)
ssh -tt host 'sleep 30'        → "sleep: missing operand"   (30 lost)
ssh -tt host 'printf ok123'    → "printf: usage: ..."       (ok123 lost)
ssh -tt host 'echo x > f.txt'  → bare echo; redirect never reaches the shell
ssh -tt host 'cmd /c echo x'   → an interactive cmd prompt  (args dropped)

The same commands work fine without -t, confirming the quoting
discrepancy between the two branches. cmd.exe and powershell.exe are not
affected because their /c/-c consume the rest of the command line —
which is presumably why this has gone unnoticed.

Expected

ssh -tt host 'sleep 30' runs sleep 30, same as without a pty.

Suggested fix

Quote the command operand in the pty branch (with proper
CommandLineToArgvW escaping for embedded quotes/backslashes), e.g.
append "%s" — noting that merely wrapping in quotes is not sufficient
for commands that already contain quotes; the escaping rules used by
build_exec_command/the non-pty path should be mirrored.

Dominant language
No language data
Stars
8.3k
Forks
822
Avg merge
3d 2h
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PowerShell/Win32-OpenSSH

All issues in PowerShell/Win32-OpenSSH

Similar issues

More Backend & API Design issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.