Executive brief
Claude Code is an AI code execution tool that requires user approval before running commands. A flaw in command parsing allowed attackers to bypass this safety confirmation prompt and execute untrusted commands. An attacker would need to inject malicious content into the Claude Code context window, potentially leading to unauthorized code execution on the user's system.
Technical details
A command injection vulnerability in the rg (ripgrep) command parsing logic allowed attackers to bypass the user approval prompt. The vulnerability (CWE-94: Improper Control of Generation of Code) stems from an error in how commands are parsed, enabling untrusted input to trigger command execution without confirmation. The attack requires the ability to introduce malicious content into the Claude Code context window and user interaction (the attacker leverages passive user interaction). The vulnerability impacts confidentiality, integrity, and availability of the vulnerable system. Patches are available in version 1.0.105 and later; auto-update users received the fix automatically.
Affected products
- Anthropic Claude Code before 1.0.105
Timeline
- 2025-09-10: disclosed
- 2025-09-10: patched: version 1.0.105