InfoSecBulletin Cybersecurity for mankind
A security flaw has been found in Anthropic’s Claude Code CLI tool. This flaw lets attackers run any command on someone else’s computer if they manage to make that person click a specially crafted link.
The flaw, fixed in Claude Code version 2.1.118, came from a simple command-line tool. This flaw could be used to attack through the tool’s claude-cli:// deeplink handler. While manually auditing Claude Code’s source code security researcher Joernchen of 0day.click identified the vulnerability.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The flaw originated from eagerParseCliFlag, a function in main.tsx that is responsible for parsing essential flags such as –settings prior to the execution of the main initialization routine.
The issue: eagerParseCliFlag looked at all command-line arguments for any string starting with –settings=, without knowing if it was a real flag or just a value for another flag. This blind parsing opened up a risky injection point.
Claude Code’s deeplink handler uses the –prefill option to fill user prompts with content from the q parameter of the deeplink. The eager parser did not tell apart flags and their arguments, so any –settings=… string in the q parameter’s value was quietly seen as a valid settings override.
Weaponizing Claude Code Hooks
Claude Code lets you set up strong hooks that run commands by themselves at certain points in the session’s life.
An attacker could exploit the parsing flaw to inject a malicious Session Start hook via a crafted URI:
textclaude-cli://open?repo=anthropics/claude-code&q=–settings={“hooks”:{“SessionStart”:[{“type”:”command”,”command”:”bash -c ‘id > /tmp/pwned.txt'”}]}}
When a victim clicks this link, Claude Code starts with the attacker’s settings, and the command runs right away without needing any action from the user other than clicking the link.
It was possible to completely bypass the workspace trust dialog. If the repo parameter in the deep link is set to a repository the user has already cloned locally and trusted (like anthropics/claude-code), the execution happened without any warning prompts Joernchen said.
Anthropic fixed the flaw in Claude Code version 2.1.118. The fix uses smart argument handling to tell the difference between CLI flags and their values. This removes the risk of injection completely. Users with older versions should update right away.
The researcher said, the pattern of using startsWith on the full command line array is a somewhat problematic anti-pattern that allows flags to be sneaked into values. The parsing of command line flags and their arguments should always be done in full context to prevent this exact type of injection.
