I reproduced a Claude Code RCE. The bug pattern is everywhere(vechron.com)

7 pointsby GeorgeWoff252 เดือนที่ผ่านมา2 comments

I reproduced a Claude Code RCE. The bug pattern is everywhere

https://vechron.com/2026/05/i-reproduced-a-claude-code-rce-the-bug-pattern-is-everywhere/

3 comments

ashishgupta22002 เดือนที่ผ่านมา

This is a good argument for treating ai agent products like you’d treat a browser or PDF reader, assume untrusted input all the way through and sandbox ruthlessly, instead of sprinkling a couple of string checks and calling it a day

GeorgeWoff252 เดือนที่ผ่านมา

Joernchen found it. I reproduced it and checked if Cursor and Continue.dev have the same startsWith parsing issue. They do.

bhartipoddar2 เดือนที่ผ่านมา