diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index 64855fb8d61934e9e955af5635273a1ccd1efd25..53d8b219ea726d2a4be570af42f78d47a9a3b6c5 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -490,6 +490,10 @@ virNetClientPtr virNetClientNewLibSSH2(const char *host,
     DEFAULT_VALUE(knownHostsVerify, "normal");
 
     virBufferEscapeShell(&buf, netcatPath);
+    if (!(nc = virBufferContentAndReset(&buf)))
+        goto no_memory;
+    virBufferEscapeShell(&buf, nc);
+    VIR_FREE(nc);
     if (!(nc = virBufferContentAndReset(&buf)))
         goto no_memory;
 
@@ -596,6 +600,10 @@ virNetClientPtr virNetClientNewLibssh(const char *host,
     DEFAULT_VALUE(knownHostsVerify, "normal");
 
     virBufferEscapeShell(&buf, netcatPath);
+    if (!(nc = virBufferContentAndReset(&buf)))
+        goto no_memory;
+    virBufferEscapeShell(&buf, nc);
+    VIR_FREE(nc);
     if (!(nc = virBufferContentAndReset(&buf)))
         goto no_memory;
 
diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c
index ebd304707a0064b4759ab066a992bd74a33aac62..a469907779d90dee430d3c9ffaf20b9b2088a8a5 100644
--- a/src/rpc/virnetsocket.c
+++ b/src/rpc/virnetsocket.c
@@ -903,6 +903,15 @@ int virNetSocketNewConnectSSH(const char *nodename,
         return -1;
     }
     quoted = virBufferContentAndReset(&buf);
+
+    virBufferEscapeShell(&buf, quoted);
+    VIR_FREE(quoted);
+    if (virBufferCheckError(&buf) < 0) {
+        virCommandFree(cmd);
+        return -1;
+    }
+    quoted = virBufferContentAndReset(&buf);
+
     /*
      * This ugly thing is a shell script to detect availability of
      * the -q option for 'nc': debian and suse based distros need this
diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
index bb8357f7cd1fb452b574fe3cb274e0591c87fd3c..8cad351605c276fe1db5425278262486cbc5aa16 100644
--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
@@ -661,15 +661,15 @@ mymain(void)
 
     struct testSSHData sshData7 = {
         .nodename = "somehost",
-        .netcat = "nc -4",
+        .netcat = "/tmp/fo o/nc",
         .path = "/tmp/socket",
         .expectOut = "-T -e none -- somehost sh -c '"
-                     "if ''nc -4'' -q 2>&1 | grep \"requires an argument\" >/dev/null 2>&1; then "
+                     "if \'''\\''/tmp/fo o/nc'\\'''' -q 2>&1 | grep \"requires an argument\" >/dev/null 2>&1; then "
                          "ARG=-q0;"
                      "else "
                          "ARG=;"
                      "fi;"
-                     "''nc -4'' $ARG -U /tmp/socket'\n",
+                     "'''\\''/tmp/fo o/nc'\\'''' $ARG -U /tmp/socket'\n",
     };
     if (virTestRun("SSH test 7", testSocketSSH, &sshData7) < 0)
         ret = -1;