Are there conditions under which an attacker with control over the server could gain access to and initiate actions on the client? I realize the attacker could plant trojans on the server in the hope that the user behind the SSH client hauls one in (either manually or by running a script), but are there other vectors of attack too?
I'm specifically interested in scenarios where no passwords are involved and only public key authentication is used, possibly with the same user credentials on both sides of the connection.