Comment by soblemprolver

I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 ("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.")

Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.