An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
Malicious servers can send malicious terminal escape codes. For example <a href="https://www.sentinelone.com/vulnerability-database/cve-2026-41253/" rel="nofollow">https://www.sentinelone.com/vulnerability-database/cve-2026-...
3dedb728-3f77 · · focus · HN ↗
People understand that reverse hacking can happen when connecting to random ssh server, right?
scubbo · · focus · HN ↗
No, actually, I've never heard of such a vector. How would that work?
jerrythegerbil · · focus · HN ↗
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
applfanboysbgon · · focus · HN ↗
FooBarWidget · · focus · HN ↗