From my investigation it seems that it's some kind of filter provided by Cloudflare, in this case blocking a possible "shell script injection".