From d8785c3d0bd63a1049bb4cf9e5d459f2fe5a1f09 Mon Sep 17 00:00:00 2001
From: A <258483684+la14-1@users.noreply.github.com>
Date: Thu, 19 Feb 2026 09:25:16 -0800
Subject: [PATCH] security: fix command injection in cline auth via remote env
 var expansion (#1473)

All 9 cline.sh scripts embedded OPENROUTER_API_KEY directly into the
cloud_run command string, allowing shell metacharacter injection on the
remote server. Fix by escaping the dollar sign (\${OPENROUTER_API_KEY})
so the variable is expanded on the remote machine where it's already
set via agent_env_vars()/generate_env_config, not locally before being
passed to cloud_run.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 aws/cline.sh          | 2 +-
 daytona/cline.sh      | 2 +-
 digitalocean/cline.sh | 2 +-
 fly/cline.sh          | 2 +-
 gcp/cline.sh          | 2 +-
 hetzner/cline.sh      | 2 +-
 local/cline.sh        | 2 +-
 ovh/cline.sh          | 2 +-
 sprite/cline.sh       | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/aws/cline.sh b/aws/cline.sh
index 4a78f9ff..7d1c2002 100755
--- a/aws/cline.sh
+++ b/aws/cline.sh
@@ -20,7 +20,7 @@ agent_env_vars() {
 }
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }
 
diff --git a/daytona/cline.sh b/daytona/cline.sh
index 13112470..ed573e99 100644
--- a/daytona/cline.sh
+++ b/daytona/cline.sh
@@ -23,7 +23,7 @@ agent_env_vars() {
 
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 
 agent_launch_cmd() {
diff --git a/digitalocean/cline.sh b/digitalocean/cline.sh
index b59c544a..a62ab2a1 100755
--- a/digitalocean/cline.sh
+++ b/digitalocean/cline.sh
@@ -20,7 +20,7 @@ agent_env_vars() {
 }
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }
 
diff --git a/fly/cline.sh b/fly/cline.sh
index ff0cca28..70eed486 100644
--- a/fly/cline.sh
+++ b/fly/cline.sh
@@ -23,7 +23,7 @@ agent_env_vars() {
 
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 
 agent_launch_cmd() {
diff --git a/gcp/cline.sh b/gcp/cline.sh
index 06cb973f..d442a690 100755
--- a/gcp/cline.sh
+++ b/gcp/cline.sh
@@ -20,7 +20,7 @@ agent_env_vars() {
 }
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }
 
diff --git a/hetzner/cline.sh b/hetzner/cline.sh
index 38ccc08e..2efca059 100755
--- a/hetzner/cline.sh
+++ b/hetzner/cline.sh
@@ -20,7 +20,7 @@ agent_env_vars() {
 }
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }
 
diff --git a/local/cline.sh b/local/cline.sh
index 6cf7a586..91d0503a 100755
--- a/local/cline.sh
+++ b/local/cline.sh
@@ -23,7 +23,7 @@ agent_env_vars() {
 
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc 2>/dev/null; cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc 2>/dev/null; cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 
 agent_launch_cmd() {
diff --git a/ovh/cline.sh b/ovh/cline.sh
index 5c3d828a..09a1543a 100755
--- a/ovh/cline.sh
+++ b/ovh/cline.sh
@@ -20,7 +20,7 @@ agent_env_vars() {
 }
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }
 
diff --git a/sprite/cline.sh b/sprite/cline.sh
index 4dd505ed..bf4270a6 100755
--- a/sprite/cline.sh
+++ b/sprite/cline.sh
@@ -23,7 +23,7 @@ agent_env_vars() {
 
 agent_configure() {
     log_step "Authenticating Cline with OpenRouter..."
-    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
+    cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
 }
 
 agent_launch_cmd() {