In virsh, the hostname could crafted maliciously with ssh arguments, which would be passed to ssh (bsc#1053600).
bugs.mageia.org/show_bug.cgi?id=21826
lists.opensuse.org/opensuse-updates/2017-10/msg00018.html