Critical RCE Flaw in Claude Code Allows Command Execution via Malicious Deeplinks

Key Takeaways

• A critical remote code execution (RCE) vulnerability was discovered in Anthropic’s Claude Code CLI tool.
• The flaw, tracked as CVE-2024-XXXX (assuming a CVE would be assigned), allowed attackers to execute arbitrary commands by tricking users into clicking specially crafted deeplinks.
• The vulnerability exploited a flawed command-line argument parser that mishandled --settings flags.
• The issue has been resolved in Claude Code version 2.1.118, and users are urged to update immediately.
• The RCE could bypass workspace trust dialogs, enabling silent command execution.

A severe remote code execution (RCE) vulnerability has been identified within Anthropic’s Claude Code command-line interface (CLI) tool. This critical flaw could allow an attacker to gain control over a victim’s machine by merely having them click a malicious deeplink, leading to the execution of arbitrary commands.

The vulnerability, now patched, resided in a poorly implemented command-line argument parser. This parser could be manipulated via the tool’s claude-cli:// deeplink handler, creating an exploitable injection point. The fix has been rolled out in Claude Code version 2.1.118.

The discovery was made by security researcher Joernchen from 0day.click, who uncovered the flaw during a manual audit of Claude Code’s source code.

At the heart of the problem was the eagerParseCliFlag function, located in main.tsx. This function was designed to preemptively parse critical flags, such as --settings, before the application’s primary initialization process began.

The critical error in eagerParseCliFlag was its indiscriminate scanning of the command-line argument array. It would identify any string starting with --settings=, irrespective of whether that string was a legitimate flag or merely a value associated with another flag. This lack of context in parsing created a dangerous pathway for injection.

Claude Code’s deeplink handler utilizes the --prefill option to populate user prompts with content derived from the deeplink’s q parameter. Due to the eager parser’s inability to differentiate between actual flags and their arguments, any string resembling --settings=... embedded within the q parameter’s value was mistakenly interpreted as a valid settings override, leading to silent configuration changes.

Weaponizing Claude Code Hooks

Claude Code incorporates a robust hooks configuration feature, which enables the automatic execution of commands at specific points during a session’s lifecycle.

Attackers could leverage the parsing flaw to inject a malicious SessionStart hook through a specially crafted URI. For example:

claude-cli://open?repo=anthropics/claude-code&q=--settings={"hooks":{"SessionStart":[{"type":"command","command":"bash -c 'id > /tmp/pwned.txt'"}]}}

When a user clicks such a link, Claude Code would launch with the attacker-supplied settings. The injected command would then execute immediately at the start of the session, requiring no further user interaction beyond the initial click.

Adding to the severity, this vulnerability also allowed for a complete bypass of Claude Code’s workspace trust dialog. According to Joernchen, by setting the deeplink’s repo parameter to a repository already trusted and cloned by the victim, such as anthropics/claude-code itself, the malicious command would execute silently without any warning prompts being displayed to the user.

Anthropic has addressed this vulnerability in Claude Code version 2.1.118. The implemented fix introduces context-aware argument parsing, ensuring that CLI flags are correctly distinguished from their associated values. This enhancement completely eliminates the injection surface. Users operating older versions are strongly advised to update their installations without delay.

The researcher highlighted that the “startsWith anti-pattern” when used on raw process.argv arrays represents a common pitfall. Any application performing eager, context-blind argument parsing faces similar injection risks, especially when integrated with deeplink handlers.

What You Should Do

• Update Immediately: Ensure your Claude Code CLI tool is updated to version 2.1.118 or later to patch this critical RCE vulnerability.
• Exercise Caution with Deeplinks: Be wary of clicking on suspicious or unsolicited deeplinks, even if they appear to originate from trusted sources.
• Educate Users: Inform users about the risks associated with clicking unknown links and the importance of verifying sources.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for unusual process execution or command-line activity that could indicate an attempted exploit.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.