CVS 1.12.x when configured to use SSH for remote repositories might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname as demonstrated by \-oProxyCommand=id;localhost:/bar.\