Claude Code Command Injection Vulnerability Allowing Bypass of Confirmation Prompt

A command injection vulnerability has been identified in Claude Code versions prior to 1.0.20. An error in command parsing allowed users to bypass the confirmation prompt, enabling the execution of untrusted commands. Exploiting this vulnerability reliably requires the ability to insert untrusted content into a Claude Code context window.

Impact

Exploitation of this vulnerability could lead to the execution of untrusted commands, potentially allowing for arbitrary command execution on the user's system.

Remediation

Users on standard Claude Code auto-update received the fix in version 1.0.20. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update.