Claude Code RCE patched after deeplink exploit

A remote code execution vulnerability in Claude Code allowed attackers to run arbitrary shell commands on a developer's machine simply by getting them to click a crafted URL. The flaw lived in the deeplink handler for claude-cli:// URLs, where an eager flag parser treated embedded --settings= strings inside the q parameter as legitimate flag overrides rather than user input to be sanitized. The most dangerous scenario: if a target repository was already marked as locally trusted, the workspace trust dialog was bypassed entirely, meaning shell commands executed silently with no prompt to the developer. An attacker needed only to share a malicious link in a chat message, GitHub issue, or doc to trigger execution. Essentially: (Anthropic, security researcher Joernchen of 0day.click) disclosed and patched a supply-chain-adjacent attack surface baked into the CLI tooling millions of developers use daily. - The flaw was in flag parsing logic, not in the AI model itself, meaning it was a classic injection vulnerability dressed in AI tooling clothing. - Silent execution was possible when the target had already trusted the repo, removing the last user-visible checkpoint. - The patch shipped in Claude Code version 2.1.118. As AI developer tools become a primary attack surface for targeting engineering organizations, CLI deeplink handlers are now a concrete threat vector that security teams need to add to their audit checklists.