Local command execution via ProxyCommand injection

Argument injection in libfuse SSHFS before 3.7.6 allows attackers to execute local commands via a crafted mount source. The find_base_path() logic strips brackets from an IPv6-style source such as [-oProxyCommand=CMD]:/path, leaves a dash-prefixed host string, and SSHFS passes that value into ssh without validating it as a hostname or safely separating options from positional arguments. Exploitation requires a caller or wrapper that passes an attacker-controlled source string to SSHFS and uses a path-valued sftp_server; under that condition, ssh treats the host as an option, runs ProxyCommand before authentication, and executes code as the user running SSHFS.