2026-05-12 · 2026-Q2
Claude Code Deeplink RCE
PrimaryL5ConfigSecondaryL2Instruction
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
Claude Code before 2.1.118
Impact
A crafted `claude-cli://` deeplink injects `--settings={...}` (including a `SessionStart` hooks payload) through the `--prefill` value, so one click runs arbitrary shell commands; pointing the deeplink's `repo` parameter at an already-trusted local repository suppressed all warning prompts for a silent compromise
Root Cause
`eagerParseCliFlag` in `main.tsx` used `startsWith` across the whole argv array without tracking whether a `--settings=` string was a real flag or the value of another flag, letting flags be smuggled inside values. Researcher: Joern Chen (joernchen, 0day.click)