openssh bugs - Oct 2025 - [Bug 3886] New: ssh <server> bash -c "cd /opt && pwd" outputs home directory

https://bugzilla.mindrot.org/show_bug.cgi?id=3886

            Bug ID: 3886
           Summary: ssh <server> bash -c "cd /opt &&
pwd" outputs home
                    directory
           Product: Portable OpenSSH
           Version: 10.1p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: roarch at proton.me

I'll start this by acknowledging that this very well could be an issue
with my specific setups, but I have tried this sshing into multiple
machines with different sshd versions from machines with different ssh
versions. This could also be a bug in bash itself, but i'd note that
this seems to  occur regardless of whether one uses xonsh, zsh, fish,
bash on both the client and server end.

```bash
ssh myserver bash -c "cd /opt && pwd && cd /opt &&
pwd"
```

OUTPUT:
```
/root
/opt
```

EXPECTED OUTPUT:
```
/opt
/opt
```
(or the cd returns an error)


this occurs with both password auth and key auth.
this happens regardless of whether i use && or ; in my command.
with `bash --norc -c` we get the same output. 


SPECULATION TIME:
it seems to either be some weird case regarding the first command given
to the shell invoked with -c, or some race condition, i'm unsure which,
or if it's some secret third thing. 
e.g. 
```bash
ssh myserver bash -c "cd /opt && cd /opt && pwd"
```
returns /opt,
```bash
ssh myserver bash -c "true; cd /opt; pwd"
```
returns /opt, but
```bash
ssh myserver bash -c "cd /opt; pwd; pwd; pwd; pwd"
``` 
just returns "/root" over and over again.

the following is possibly a red herring, but note that
```
ssh myserver bash -vc "cd /opt && pwd" # with verbose bash
output
```
when ran repeatedly, the cd command shows up either before or after the
pwd output, seemingly at random. the reason i think it may be a red
herring is that I still get "/root" as the pwd output 100% of the
time.

at this point I'm basically at the end of my expertise, so not really
sure where to go from here. again I must apologise if i'm missing
something here, but i've gotten a few friends with their own servers to
test it, with various shells, and even from a fresh Ubuntu VM to a
fresh Ubuntu VM. Also sorry if this is a bit of a messy report - I've
stayed late at work to try to figure this out (despite it not being a
blocker at all) and at this point I would like to go home :) I can
reword it later if it proves a big issue.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3886

Rowan AJ <roarch at proton.me> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Rowan AJ <roarch at proton.me> ---
welp, i stumbled upon
https://superuser.com/questions/1678446/why-bash-c-cd-pwd-fails-when-it-is-run-via-ssh
- as somewhat expected the issue is PICNIC - sorry for the false
report!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.