InfoSecBulletin Cybersecurity for mankind
A security flaw has been found in Anthropic’s Claude Code CLI tool. This flaw lets attackers run any command on someone else’s computer if they manage to make that person click a specially crafted link.
The flaw, fixed in Claude Code version 2.1.118, came from a simple command-line tool. This flaw could be used to attack through the tool’s claude-cli:// deeplink handler. While manually auditing Claude Code’s source code security researcher Joernchen of 0day.click identified the vulnerability.
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
CVE-2026-0257
Palo Alto Warns of GlobalProtect VPN Vuln Actively Exploited
BD Gov.t to set up Tk192.66cr AI hub with support from Koica
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases With Zero Authentication
Anthropic disables Fable 5 and Mythos 5 Access after US order limiting foreign access
The flaw originated from eagerParseCliFlag, a function in main.tsx that is responsible for parsing essential flags such as –settings prior to the execution of the main initialization routine.
The issue: eagerParseCliFlag looked at all command-line arguments for any string starting with –settings=, without knowing if it was a real flag or just a value for another flag. This blind parsing opened up a risky injection point.
Claude Code’s deeplink handler uses the –prefill option to fill user prompts with content from the q parameter of the deeplink. The eager parser did not tell apart flags and their arguments, so any –settings=… string in the q parameter’s value was quietly seen as a valid settings override.
Weaponizing Claude Code Hooks
Claude Code lets you set up strong hooks that run commands by themselves at certain points in the session’s life.
An attacker could exploit the parsing flaw to inject a malicious Session Start hook via a crafted URI:
textclaude-cli://open?repo=anthropics/claude-code&q=–settings={“hooks”:{“SessionStart”:[{“type”:”command”,”command”:”bash -c ‘id > /tmp/pwned.txt'”}]}}
When a victim clicks this link, Claude Code starts with the attacker’s settings, and the command runs right away without needing any action from the user other than clicking the link.
It was possible to completely bypass the workspace trust dialog. If the repo parameter in the deep link is set to a repository the user has already cloned locally and trusted (like anthropics/claude-code), the execution happened without any warning prompts Joernchen said.
Anthropic fixed the flaw in Claude Code version 2.1.118. The fix uses smart argument handling to tell the difference between CLI flags and their values. This removes the risk of injection completely. Users with older versions should update right away.
The researcher said, the pattern of using startsWith on the full command line array is a somewhat problematic anti-pattern that allows flags to be sneaked into values. The parsing of command line flags and their arguments should always be done in full context to prevent this exact type of injection.
