Claude Code Command Injection Vulnerability Allowing Bypass of Confirmation Prompt

A command injection vulnerability has been identified in Claude Code versions prior to 1.0.105. This issue arises from a flaw in command parsing, which allowed users to bypass the confirmation prompt and execute untrusted commands. Exploitation of this vulnerability requires the ability to insert untrusted content into a Claude Code context window.

Impact

Exploitation of this vulnerability could lead to the execution of untrusted commands, potentially allowing for arbitrary command execution depending on the context in which Claude Code is running.

Remediation

Users on standard Claude Code auto-update will have received the fix automatically. Those performing manual updates should update to version 1.0.105 or the latest version.