InfoSecBulletin Cybersecurity for mankind
A security flaw has been found in Anthropic’s Claude Code CLI tool. This flaw lets attackers run any command on someone else’s computer if they manage to make that person click a specially crafted link.
The flaw, fixed in Claude Code version 2.1.118, came from a simple command-line tool. This flaw could be used to attack through the tool’s claude-cli:// deeplink handler. While manually auditing Claude Code’s source code security researcher Joernchen of 0day.click identified the vulnerability.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
The flaw originated from eagerParseCliFlag, a function in main.tsx that is responsible for parsing essential flags such as –settings prior to the execution of the main initialization routine.
The issue: eagerParseCliFlag looked at all command-line arguments for any string starting with –settings=, without knowing if it was a real flag or just a value for another flag. This blind parsing opened up a risky injection point.
Claude Code’s deeplink handler uses the –prefill option to fill user prompts with content from the q parameter of the deeplink. The eager parser did not tell apart flags and their arguments, so any –settings=… string in the q parameter’s value was quietly seen as a valid settings override.
Weaponizing Claude Code Hooks
Claude Code lets you set up strong hooks that run commands by themselves at certain points in the session’s life.
An attacker could exploit the parsing flaw to inject a malicious Session Start hook via a crafted URI:
textclaude-cli://open?repo=anthropics/claude-code&q=–settings={“hooks”:{“SessionStart”:[{“type”:”command”,”command”:”bash -c ‘id > /tmp/pwned.txt'”}]}}
When a victim clicks this link, Claude Code starts with the attacker’s settings, and the command runs right away without needing any action from the user other than clicking the link.
It was possible to completely bypass the workspace trust dialog. If the repo parameter in the deep link is set to a repository the user has already cloned locally and trusted (like anthropics/claude-code), the execution happened without any warning prompts Joernchen said.
Anthropic fixed the flaw in Claude Code version 2.1.118. The fix uses smart argument handling to tell the difference between CLI flags and their values. This removes the risk of injection completely. Users with older versions should update right away.
The researcher said, the pattern of using startsWith on the full command line array is a somewhat problematic anti-pattern that allows flags to be sneaked into values. The parsing of command line flags and their arguments should always be done in full context to prevent this exact type of injection.
