Skip to content

2026-02-03 — Claude Code command injection (find) bypasses user approval (GHSA-qgqw-h4xq-7w8w)

What happened: Claude Code had a command-injection condition involving a find command, allowing execution that could bypass an intended user approval prompt.

Why it matters: “Approval gates” are only meaningful if there is no way to: - smuggle extra arguments/flags - inject shell metacharacters - coerce tool invocation paths

In agent systems, this can turn a “read-only” or “ask first” tool into silent code execution.

Durable guidance (defensive)

  1. Never build shell commands by string concatenation

  2. Use execve/spawn with an argv array.

  3. Avoid the shell entirely

  4. For filesystem search, prefer native APIs (walk directory trees) over invoking find.

  5. Make approval gates structural

  6. The gate should authorize a specific action object (tool + arguments), not a raw string.

  7. Recompute/validate the action at execution time.

  8. Constrain tool capabilities by default

  9. Run agent tools in a sandbox with no ambient credentials.

  10. Block outbound network unless explicitly required.

  11. Log and alert on “unexpected” execution

  12. Unexpected flags, paths outside workspace, or commands with metacharacters should trigger high-severity telemetry.

Status

See the upstream advisory for affected versions and fix details.

References