That's correct - AIUI, the ssh utility has to smush the command & arguments into a single string, because that's all the protocol's "exec" request can handle:

That's correct - AIUI, the ssh utility has to smush the command & arguments into a single string, because that's all the protocol's "exec" request can handle: https://tools.ietf.org/html/rfc4254#section-6.5 https://tools.ietf.org/html/rfc4254#section-6.5 And I guess it can't really do any quoting/escaping, because there's no guarantees in the protocol as to how such things will be interpreted server-side - the command line could be interpreted by cmd.exe on the server for all `ssh` knows ;) With that in mind, I've made it a habit to always quote the command-and-parameters part of `ssh` lines into a single argument - I figure, that's what it's doing anyway, so it's best to be explicit about it. And when I know I'm working with bash on both ends, my pattern of choice is ssh host "$(printf '%q ' cmd arg 'arg with spaces' "$var" ...)"