Anthropic’s Claude Code Exposes RCE via Deeplinks

Anthropic’s Claude Code tool recently faced a significant security breach due to a remote code execution (RCE) flaw. Discovered by security researcher Joernchen of 0day.click, this vulnerability allowed attackers to execute arbitrary commands on a victim’s machine using malicious deeplinks. The issue originated from a naive command-line argument parser in the tool’s claude-cli:// deeplink handler. By exploiting this flaw, attackers could inject harmful commands that executed automatically, bypassing the tool’s workspace trust dialog. Claude Code’s eagerParseCliFlag function failed to differentiate between CLI flags and their values, enabling an injection point via the tool’s hooks configuration. This allowed for seamless command execution when users clicked the malicious link. Anthropic patched the flaw in Claude Code version 2.1.118 using context-aware argument parsing. Users of older versions should update promptly. The incident highlights vulnerabilities tied to context-blind argument parsing.

For further details, read the full article at:

Claude Code RCE Flaw Lets Attackers Execute Commands via Malicious Deeplinks