STUPID-2026-0121
Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution
Why 8/10
A shell-parsing trick bypassed the read-only command check (CVSS 8.7). Fixed in 1.0.93; no exploitation reported.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
N/A — this is a flaw in Claude Code's own read-only command validator, the layer that is supposed to let an agent run "safe" shell commands without further confirmation, not a task a user asked the agent to perform.
Expected behavior
Claude Code's read-only mode should approve a proposed shell command only if the command genuinely cannot mutate the system or execute arbitrary code — which requires the validator to correctly parse shell syntax, including `$IFS`-based word splitting and short CLI flag forms, rather than pattern-matching on a surface form of the command.
Actual behavior
Errors in how Claude Code's command validator parsed shell commands involving `$IFS` and short CLI flags let a command that would actually execute arbitrary code be classified as read-only and approved without further confirmation. Reliable exploitation required getting attacker-controlled content into the agent's context window — an injection vector — at which point the read-only gate no longer blocked code execution.
Damage
Tracked as CVE-2025-66032 (GHSA-xq4m-mc3c-vvg3, CWE-77: Improper Neutralization of Special Elements in a Command, CVSS v4.0 8.7/High). Reported by security researcher RyotaK of GMO Flatt Security Inc. and published directly on Anthropic's own claude-code security-advisories page. Affected `@anthropic-ai/claude-code` versions before 1.0.93; fixed in 1.0.93 by replacing the command blocklist with an allowlist. Users on Claude Code's standard auto-update received the fix automatically. No in-the-wild exploitation was reported — this was a responsibly disclosed research finding, not an observed attack.
Full write-up
Claude Code's read-only permission mode exists so the agent can run commands it judges non-mutating — reads, searches, status checks — without stopping to ask the user first. Security researcher RyotaK of GMO Flatt Security Inc. found that the validator behind that gate mis-parsed shell syntax involving $IFS (the shell's field-separator variable, usable in place of a literal space) and certain short CLI flag forms, which made it possible to construct a command that the validator judged read-only but that, once actually run, executed arbitrary code. The read-only check was pattern-matching a surface form of the command rather than correctly parsing what the shell would do with it.
Anthropic's own advisory is explicit about the precondition: "reliably exploiting this requires the ability to add untrusted content into a Claude Code context window" — this is a bypass that becomes dangerous once combined with a prompt-injection vector (a malicious file, issue, or tool output the agent reads), not something a user triggers directly. Tracked as CVE-2025-66032 (GHSA-xq4m-mc3c-vvg3, CWE-77, CVSS v4.0 8.7/High), the flaw affected @anthropic-ai/claude-code versions before 1.0.93 and was fixed in that release by replacing the validator's blocklist approach with an allowlist — a structural fix rather than a patch for the specific parsing bug, since a blocklist of "which commands aren't safe" is exactly the kind of check this bypass exploited. Users on Claude Code's standard auto-update channel received the fix without action; no in-the-wild exploitation of the flaw was reported before the fix shipped.
Classification
- Agent
- Claude Code
- Failure mode
- Security Vulnerability
- Root cause
- Logic Error
- Domain
- Security
- OWASP Agentic Top 10 (our mapping)
- ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0121: Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0121/ (accessed 2026-11-13). CC BY 4.0.
← STUPID-2026-0120By IDSTUPID-2026-0122 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.