2026-05-12 · 2026-Q2
Claude Code Deeplink RCE
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Claude Code before 2.1.118
Impact
A crafted `claude-cli://` deeplink injects `--settings={...}` (including a `SessionStart` hooks payload) through the `--prefill` value, so one click runs arbitrary shell commands; pointing the deeplink's `repo` parameter at an already-trusted local repository suppressed all warning prompts for a silent compromise
Root cause
`eagerParseCliFlag` in `main.tsx` used `startsWith` across the whole argv array without tracking whether a `--settings=` string was a real flag or the value of another flag, letting flags be smuggled inside values. Researcher: Joern Chen (joernchen, 0day.click)
Sources
Catalog
Cite this: AgentProv incident record: Claude Code Deeplink RCE (2026-05-12). https://agentprov.com/incidents/2026-05-12-claude-code-deeplink-rce
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config