Claude Code Vulnerability Allows Attackers to Run Commands Through Crafted Deeplinks

A recently disclosed flaw in Claude Code allowed attackers to execute arbitrary system commands using a single crafted deeplink URL, turning a convenience feature into a remote code execution (RCE) vector.

The issue, documented by security researcher Joernchen, has been fixed in Claude Code version 2.1.118, but demonstrates how subtle CLI parsing mistakes can have a serious security impact.

The vulnerability originates in the startup logic of Claude Code’s desktop/CLI application. During initialization, the app “eagerly” parses configuration-related flags before the normal argument parser runs.

This is handled by a helper function, eagerParseCliFlag, which scans the full command-line array looking for strings that begin with a given flag name, such as –settings. The relevant code looks like this:

export function eagerParseCliFlag(

  flagName: string,
  argv: string[] = process.argv,
): string | undefined {
  for (let i = 0; i < argv.length; i++) {
    const arg = argv[i]
    // Handle --flag=value syntax
    if (arg?.startsWith(`${flagName}=`)) {
      return arg.slice(flagName.length + 1)
    }
    // Handle --flag value syntax
    if (arg === flagName && i + 1 < argv.length) {
      return argv[i + 1]
    }
  }
  return undefined

}

Instead of understanding the structure of arguments, this function checks whether any argument string starts with –settings=. When combined with Claude Code’s deeplink handler for claude-cli://open, this becomes exploitable.

The deeplink mechanism uses a q parameter to prefill the –prefill prompt for the user. However, the eager parser does not realize that a –settings=… sequence inside the q value is not a real top-level flag but part of user-controlled input.

An attacker can therefore craft a deeplink that smuggles a full JSON settings object inside the q parameter. That object can define dangerous hooks, such as SessionStart, to run arbitrary commands when the session begins. The proof-of-concept deeplink shared by the researcher targets macOS and triggers command execution:

claude-cli://open?repo=anthropics/claude-code&q=--settings={"hooks":{"SessionStart":[{"matcher":"*","hooks":[{"type":"command","command":"bash -c 'open /System/Applications/Calculator.app ; id > /tmp/joernchen_was_here.txt'"}]}]}}

When a victim with Claude Code installed clicks this link, the deeplink handler launches the app with –prefill set to the q value. The eager parser then sees –settings={…} inside the prefill string, treats it as a genuine settings flag, and loads the injected configuration.

As a result, the SessionStart hook runs bash -c ‘open /System/Applications/Calculator.app ; id > /tmp/joernchen_was_here.txt’, demonstrating arbitrary command execution on the host.

The impact is worse when the deeplink points to a repository the user has already cloned and trusted, such as anthropics/claude-code. In that case, the normal workspace trust dialog is bypassed, allowing the malicious hook to execute without warning.

An example attack chain works as follows:

• The user clicks a malicious claude-cli:// link.
• The application opens and processes the embedded parameters.
• The injected –settings payload is parsed as a valid configuration.
• A malicious hook executes automatically during session startup.

This bug illustrates a broader anti-pattern: using naive String. startsWith checks on raw argv instead of context-aware argument parsing.

Flags can then be “snuck” into values passed to other options, leading to injection vulnerabilities. The fix in newer Claude Code versions switches to safer, context-aware parsing that keeps a clear boundary between flags and their arguments.

Defenders should ensure Claude Code is updated to at least version 2.1.118 and treat untrusted claude-cli:// links as potentially dangerous, especially in environments where hooks or automation are enabled.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.