Executive brief
Network-AI's ClaudeHookBridge is a security gate for Claude Code that checks Bash commands against operator-configured blocklists before execution. The component truncates commands to 500 characters when checking the blocklist, but Claude Code executes the full untruncated command. An attacker can pad a malicious command with leading content to push dangerous operations past byte 500, bypassing the blocklist entirely and executing arbitrary commands with full system access.
Technical details
The vulnerability is a validator/executor mismatch in ClaudeHookBridge's handlePreToolUse hook. The extractTarget function (line 166 in lib/claude-hooks.ts) returns only the first 500 characters of the command field via v.slice(0, 500), and the deny-pattern matching in handlePreToolUse (line 267) evaluates denyPatterns against this truncated 500-character preview. However, Claude Code subsequently executes the full untruncated tool_input.command that was never modified by the bridge. An attacker can position destructive content past byte 500 using simple padding (e.g., repeating colons or comments), making it invisible to the regex-based denyPatterns check while ensuring it executes. In default observe mode, denyPatterns is the sole hard-block mechanism; the truncation completely defeats it. The audit log stores only the truncated benign-looking target, hiding the attack. Attack requires the ability to emit tool calls (e.g., a compromised or constrained Claude agent) and assumes denyPatterns are configured as a security control. The fix is to run pattern matching against the full untruncated input and use truncation only for display/audit purposes.
Affected products
- Network-AI ClaudeHookBridge before 5.15.1
Timeline
- 2026-07-28: disclosed
- 2026-08-13: advisory