Anchor SSH argument safe-set check with \A..\z to reject trailing newlines

features/flags.feature

@@ -436,6 +436,18 @@ Feature: Global flags
       Running SSH command: docker exec '--env MY_VAR=value' 'wordpress' sh -c
       """
 
+  @skip-windows @skip-macos
+  Scenario: SSH arguments with a trailing newline should be escaped
+    # A trailing newline used to satisfy the "safe characters" check because
+    # PCRE's $ anchor also matches just before a final newline, letting the
+    # argument reach the remote shell unquoted.
+    When I try `newline_arg="$(printf 'foo\nx')"; wp --debug --ssh=wordpress option get "${newline_arg%x}"`
+    Then STDERR should contain:
+      """
+      Running SSH command: ssh -T -vvv 'wordpress' 'wp --debug option get '\''foo
+      '\'''
+      """
+
   Scenario: SSH connection string with leading hyphen in host should error
     # The payload must not contain a slash, as that would be parsed as the path
     # and thus separated from the host.

php/WP_CLI/Runner.php

@@ -1044,7 +1044,10 @@ private function run_ssh_command( string $connection_string ): void {
 		foreach ( $wp_args as $arg ) {
 			// Quote empty strings and arguments with any characters outside the safe set.
 			// The empty string check is explicit for clarity, though regex would also catch it.
-			if ( '' !== $arg && preg_match( '/^[a-zA-Z0-9_=.\/:-]+$/', $arg ) ) {
+			// Anchor with \A and \z rather than ^ and $: PCRE's $ also matches just before a
+			// trailing newline, which would let a value ending in "\n" skip escaping and smuggle
+			// a command separator into the remote shell command.
+			if ( '' !== $arg && preg_match( '/\A[a-zA-Z0-9_=.\/:-]+\z/', $arg ) ) {
 				$escaped_args[] = $arg;
 			} else {
 				$escaped_args[] = escapeshellarg( $arg );