InfoSecBulletin Cybersecurity for mankind
A security flaw has been found in Anthropic’s Claude Code CLI tool. This flaw lets attackers run any command on someone else’s computer if they manage to make that person click a specially crafted link.
The flaw, fixed in Claude Code version 2.1.118, came from a simple command-line tool. This flaw could be used to attack through the tool’s claude-cli:// deeplink handler. While manually auditing Claude Code’s source code security researcher Joernchen of 0day.click identified the vulnerability.
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
The flaw originated from eagerParseCliFlag, a function in main.tsx that is responsible for parsing essential flags such as –settings prior to the execution of the main initialization routine.
The issue: eagerParseCliFlag looked at all command-line arguments for any string starting with –settings=, without knowing if it was a real flag or just a value for another flag. This blind parsing opened up a risky injection point.
Claude Code’s deeplink handler uses the –prefill option to fill user prompts with content from the q parameter of the deeplink. The eager parser did not tell apart flags and their arguments, so any –settings=… string in the q parameter’s value was quietly seen as a valid settings override.
Weaponizing Claude Code Hooks
Claude Code lets you set up strong hooks that run commands by themselves at certain points in the session’s life.
An attacker could exploit the parsing flaw to inject a malicious Session Start hook via a crafted URI:
textclaude-cli://open?repo=anthropics/claude-code&q=–settings={“hooks”:{“SessionStart”:[{“type”:”command”,”command”:”bash -c ‘id > /tmp/pwned.txt'”}]}}
When a victim clicks this link, Claude Code starts with the attacker’s settings, and the command runs right away without needing any action from the user other than clicking the link.
It was possible to completely bypass the workspace trust dialog. If the repo parameter in the deep link is set to a repository the user has already cloned locally and trusted (like anthropics/claude-code), the execution happened without any warning prompts Joernchen said.
Anthropic fixed the flaw in Claude Code version 2.1.118. The fix uses smart argument handling to tell the difference between CLI flags and their values. This removes the risk of injection completely. Users with older versions should update right away.
The researcher said, the pattern of using startsWith on the full command line array is a somewhat problematic anti-pattern that allows flags to be sneaked into values. The parsing of command line flags and their arguments should always be done in full context to prevent this exact type of injection.
