Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).