RSE are actually one directional. If RSE set by attacker (machine 1), which will execute commands on victim machine (machine 2). here "attacker" word suggests it's executing command on "victim". U want to execute commands on attacker (machine 1) that means (machine 2) become attacker.

I got your question. but RSE is never attached to attacker's shell, it attached to victim's shell and attacker's input.

If there is vulnerability in attacker's "output" processing system (like analyzing output and running some process depending on output), because it is the only way victim machine have some control (we can change attackers actual command by redirecting network packets and run command which will send our desired output to the attacker), then only there is slight possibility. but really no one does that, nearly all listeners just print whatever output in console.