Claude Code RCE Flaw Lets Attackers Execute Commands via Malicious Deeplinks

A critical RCE in Anthropic's Claude Code CLI deeplink handler allowed attackers to embed a malicious --settings payload inside the deeplink q parameter due to eager, context-blind parsing of command-line arguments. By injecting a SessionStart hook, an attacker could execute arbitrary commands (e.g., bash -c 'id >/tmp/pwned.txt') when a user clicked the crafted link, and the flaw could bypass workspace trust if the deeplink referenced a trusted repo; Anthropic patched the issue in version 2.1.118 and users are urged to update.