Claude Code Command Validation Bypass Leading to Arbitrary Code Execution
Vulnerability
A vulnerability in Claude Code prior to version 1.0.93 allows for arbitrary code execution by bypassing the read-only validation. This issue arises from improper parsing of shell commands related to the internal field separator (IFS) and short command-line flags. Exploiting this vulnerability requires the ability to insert untrusted content into a Claude Code context window.
Impact
Bypassing the read-only validation enables arbitrary code execution within the Claude Code environment.
Remediation
Users on standard Claude Code auto-update have received the fix in version 1.0.93. Those performing manual updates should update to the latest version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.