🕷️
SetupAI
繁
🗾Stalecollected in 83m

Claude Code RCE Vuln via Repo Settings

Claude Code RCE Vuln via Repo Settings
PostLinkedIn
🗾Read original on ITmedia AI+ (日本)
#rce-vuln#supply-chain#api-securityclaude-codeclaude-codeanthropiccheck-point

💡Claude Code RCE vuln fixed—audit your repos to avoid API key theft

⚡ 30-Second TL;DR

What Changed

Vulnerability enables RCE and API key theft via malicious repo settings

Why It Matters

The issue has been patched.

What To Do Next

Scan Claude Code workspaces for untrusted repos and update to latest version.

Who should care:Developers & AI Engineers

Key Points

  • •Vulnerability enables RCE and API key theft via malicious repo settings
  • •Exploited by opening untrusted repository configurations in Claude Code
  • •Patch deployed; highlights AI dev tool supply chain vulnerabilities
  • •Reported by Check Point security researchers

🧠 Deep Insight

Background and context from public sources — not the original article. 7 sources cited.

🔑 Enhanced Key Takeaways

  • •Check Point researchers demonstrated RCE exploitation using repository hooks in .claude/settings.json to execute arbitrary shell commands like reverse shells upon project opening[1].
  • •Vulnerabilities exploited multiple mechanisms: untrusted MCP servers via .mcp.json with 'enableAllProjectMcpServers' true, and ANTHROPIC_BASE_URL override for plaintext API key exfiltration before trust prompts[1][3].
  • •Anthropic implemented an enhanced warning dialog for untrusted configurations and plans additional granular risk controls in upcoming releases[1].
  • •Separate SSRF flaw CVE-2026-24052 used flawed startsWith() domain validation for WebFetch requests, enabling data exfiltration via subdomains like modelcontextprotocol.io.attacker.com[2].

🛠️ Technical Deep Dive

  • •Primary RCE via project hooks in .claude/settings.json bypassed user consent on Claude Code startup, executing shell commands without confirmation (No CVE, CVSS 8.7, fixed v1.0.87 Sep 2025)[3].
  • •CVE-2025-59536 (CVSS 8.7) allowed shell command injection on tool init via .mcp.json or claude/settings.json overriding MCP approvals (fixed v1.0.111 Oct 2025)[1][3].
  • •CVE-2026-21852 (CVSS 5.3) exposed API keys by setting ANTHROPIC_BASE_URL to attacker endpoint before trust dialog (fixed v2.0.65 Jan 2026)[3].
  • •CVE-2026-24052 SSRF from startsWith() validation flaw in trusted domains for WebFetch, exploitable via crafted subdomains (fixed v1.0.111)[2].

🔮 Future ImplicationsAI analysis grounded in cited sources

AI coding tools will face ongoing supply chain attacks via repo configs
Check Point and others note similar flaws recur in agentic tools due to auto-execution of untrusted project files before user consent[1][5].
Enhanced trust dialogs will become standard in AI dev platforms
Anthropic's post-patch warning improvements and planned granular controls set precedent for explicit repo trust verification[1].
Organizations must audit AI tool configs in enterprise repos
Silent RCE and key theft from cloned repos highlight need for behavioral changes like strict warnings and updates[5].

⏳ Timeline

2025-09
No CVE hook vuln fixed in Claude Code v1.0.87
2025-10
CVE-2025-59536 MCP/shell injection fixed in v1.0.111
2026-01
CVE-2026-21852 API key exfil fixed in v2.0.65
2026-02-03
CVE-2026-24052 SSRF published to NVD
2026-02
Check Point discloses RCE/API theft vulns to Anthropic
🗾Read original article on ITmedia AI+ (日本)
📰

Weekly AI Recap

Read this week's curated digest of top AI events →

👉Related Updates

Same topic

Explore #rce-vuln

Same product

More on Claude Code

Same source

Latest from ITmedia AI+ (日本)

Japan Tightens the AI Hardware Pipeline

Japan Tightens the AI Hardware Pipeline

虎嗅•Aug 22
China’s Domestic HDD Industry Returns

China’s Domestic HDD Industry Returns

钛媒体•Aug 22

AI-curated news aggregator. All content rights belong to original publishers.
Original source: ITmedia AI+ (日本) ↗

This is a summary, not the original. Read the source, or get the weekly briefing.

Weekly AI briefing

One email a week. Unsubscribe anytime.