An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
Agreed, bugs in the terminal emulator are probably more concerning. The attack surface of those is much larger (there are some pretty wild ANSI escape sequences, and terminal emulators are often granted pretty wide disk access permissions on systems that have them if they're also used for local development).
Malicious servers can send malicious terminal escape codes. For example <a href="https://www.sentinelone.com/vulnerability-database/cve-2026-41253/" rel="nofollow">https://www.sentinelone.com/vulnerability-database/cve-2026-...
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
At least for the more prominent terminal emulators i expect they probably devote a great deal of attention to security. They are developing the most commonly used interfaces for linking the most numerous, varied, and/or critical systems on the planet.
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this.
<a href="https://nvd.nist.gov/vuln/detail/cve-2026-55200" rel="nofollow">https://nvd.nist.gov/vuln/detail/cve-2026-55200
("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.")
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
3dedb728-3f77 · · focus · HN ↗
People understand that reverse hacking can happen when connecting to random ssh server, right?
scubbo · · focus · HN ↗
No, actually, I've never heard of such a vector. How would that work?
jerrythegerbil · · focus · HN ↗
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
applfanboysbgon · · focus · HN ↗
Oxodao · · focus · HN ↗
LoganDark · · focus · HN ↗
tyingq · · focus · HN ↗
LoganDark · · focus · HN ↗
tyingq · · focus · HN ↗
LoganDark · · focus · HN ↗
lxgr · · focus · HN ↗
FooBarWidget · · focus · HN ↗
dinkelberg · · focus · HN ↗
nativeit · · focus · HN ↗
dinkelberg · · focus · HN ↗
Went to Alacritty. No mentions of security.
Went to Ghostty. No mentions of security, except for "secure keyboard entry".
None have a "security policy" on GitHub.
All written in memory unsafe languages (C, Zig).
soblemprolver · · focus · HN ↗
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
fulafel · · focus · HN ↗
soblemprolver · · focus · HN ↗
fulafel · · focus · HN ↗
applfanboysbgon · · focus · HN ↗
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.