InfoSecBulletin Cybersecurity for mankind
A security flaw has been found in Anthropic’s Claude Code CLI tool. This flaw lets attackers run any command on someone else’s computer if they manage to make that person click a specially crafted link.
The flaw, fixed in Claude Code version 2.1.118, came from a simple command-line tool. This flaw could be used to attack through the tool’s claude-cli:// deeplink handler. While manually auditing Claude Code’s source code security researcher Joernchen of 0day.click identified the vulnerability.
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
The flaw originated from eagerParseCliFlag, a function in main.tsx that is responsible for parsing essential flags such as –settings prior to the execution of the main initialization routine.
The issue: eagerParseCliFlag looked at all command-line arguments for any string starting with –settings=, without knowing if it was a real flag or just a value for another flag. This blind parsing opened up a risky injection point.
Claude Code’s deeplink handler uses the –prefill option to fill user prompts with content from the q parameter of the deeplink. The eager parser did not tell apart flags and their arguments, so any –settings=… string in the q parameter’s value was quietly seen as a valid settings override.
Weaponizing Claude Code Hooks
Claude Code lets you set up strong hooks that run commands by themselves at certain points in the session’s life.
An attacker could exploit the parsing flaw to inject a malicious Session Start hook via a crafted URI:
textclaude-cli://open?repo=anthropics/claude-code&q=–settings={“hooks”:{“SessionStart”:[{“type”:”command”,”command”:”bash -c ‘id > /tmp/pwned.txt'”}]}}
When a victim clicks this link, Claude Code starts with the attacker’s settings, and the command runs right away without needing any action from the user other than clicking the link.
It was possible to completely bypass the workspace trust dialog. If the repo parameter in the deep link is set to a repository the user has already cloned locally and trusted (like anthropics/claude-code), the execution happened without any warning prompts Joernchen said.
Anthropic fixed the flaw in Claude Code version 2.1.118. The fix uses smart argument handling to tell the difference between CLI flags and their values. This removes the risk of injection completely. Users with older versions should update right away.
The researcher said, the pattern of using startsWith on the full command line array is a somewhat problematic anti-pattern that allows flags to be sneaked into values. The parsing of command line flags and their arguments should always be done in full context to prevent this exact type of injection.
