{"id":"TECH-202611-vz46rd","kind":"technique","aliases":[],"related":["TECH-202611-ackg3u"],"title":"Claude Code before 2.1.325 has several security fixes: a zstd response decoding issue, Bash commands that could run without a permission prompt, and gaps in the Bash sandbox (Anthropic fixed in 2.1.325, no CVE)","description":null,"summary":"Anthropic released Claude Code 2.1.325 on 13 Nov 2026. The release notes list 'a security issue in how zstd-compressed responses are decoded' with no further detail. The same release fixes: some compound Bash commands running without asking for permission; a Bash allow rule that could run a different program than the one it names; some deny and ask rules not applying to certain Bash commands; relative deny rules (e.g. Read(./.env)) no longer covering the project after a cd; deny rules not applied to approvals that arrive after a restart in self-hosted runner and 'claude remote-control' sessions; the Bash sandbox not fully protecting a worktree's settings and hooks or a linked worktree's shared git folder; sandboxed commands able to write to the native updater's download folder; a committed .claude/settings.local.json being treated as the user's own in some subfolders; and Bedrock token counting sending the conversation to Bedrock when allowedProviders does not allow it. Whether any of these were exploited is unknown; no CVE or advisory yet. This is separate from the 2.1.321 fixes (TECH-202611-ackg3u).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Code","fixed":[],"vendor":"Anthropic","package":"@anthropic-ai/claude-code","fixed_in":"2.1.325","ecosystem":"npm"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Run 'claude --version' (or check the @anthropic-ai/claude-code npm package version): anything below 2.1.325 lacks these fixes. Look at .claude/settings.local.json files committed to repos, and at Bash allow rules and deny rules (Read(./.env)-style) that you rely on to block commands or files. Exploit details and indicators: unknown.","fix":"Update Claude Code to 2.1.325 or later (claude update, or npm i -g @anthropic-ai/claude-code@latest) on developer machines, CI and self-hosted runners. Until updated, do not rely on Bash allow/deny rules or the Bash sandbox alone to stop untrusted repos or prompt-injected commands, and do not commit .claude/settings.local.json.","status":"open","published_at":null,"first_seen_at":"2026-11-13T21:20:05+00:00","triaged_at":"2026-11-13T21:20:05+00:00","updated_at":"2026-11-13T21:21:37+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':36A,228B '/.env':116B '13':50B '2.1.321':225B '2.1.325':4A,32A,48B '2026':52B 'abl':169B 'ackg3u':229B 'advisori':218B 'allow':87B,205B 'allowedprovid':202B 'anthrop':29A,44B 'appli':106B,128B 'approv':130B 'arriv':132B 'ask':82B,103B 'bash':14A,27A,78B,86B,109B,148B 'bedrock':193B,200B 'cd':124B 'certain':108B 'claud':1A,46B,142B 'claude':38A 'claude/settings.local.json':181B 'code':2A,39A,47B 'command':15A,79B,110B,168B 'commit':180B 'compound':77B 'compress':64B 'control':145B 'convers':198B 'could':17A,90B 'count':195B 'cover':119B 'cve':34A,216B 'decod':12A,67B 'deni':101B,112B,125B 'detail':71B 'differ':93B 'download':177B 'e.g':114B 'earli':41B 'early-warn':40B 'exploit':212B 'fix':8A,30A,75B,226B 'folder':166B,178B 'fulli':151B 'gap':24A 'git':165B 'hook':158B 'host':139B 'issu':13A,59B 'link':161B 'list':56B 'longer':118B 'name':99B 'nativ':174B 'note':55B 'nov':51B 'one':97B 'permiss':21A,84B 'program':94B 'project':121B 'prompt':22A 'protect':152B 'read':115B 'relat':111B 'releas':45B,54B,74B 'remot':144B 'remote-control':143B 'respons':11A,65B 'restart':135B 'rule':88B,104B,113B,126B 'run':18A,80B,91B 'runner':140B 'sandbox':28A,149B,167B 'secur':7A,58B 'self':138B 'self-host':137B 'send':196B 'separ':222B 'session':146B 'set':156B 'sever':6A 'share':164B 'subfold':191B 'tech':35A,227B 'techniqu':43B 'token':194B 'treat':183B 'unknown':214B 'updat':175B 'user':186B 'vz46rd':37A 'warn':42B 'whether':207B 'without':19A,81B 'worktre':154B,162B 'write':171B 'yet':219B 'zstd':10A,63B 'zstd-compress':62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["claudecode"],"ptokens":["claude","code"],"labels":["aitooling","earlywarning","medium","technique"],"campaign_type":"exploitation","search_a":"'-202611':36A '2.1.325':4A,32A 'anthrop':29A 'bash':14A,27A 'claud':1A 'claude':38A 'code':2A,39A 'command':15A 'could':17A 'cve':34A 'decod':12A 'fix':8A,30A 'gap':24A 'issu':13A 'permiss':21A 'prompt':22A 'respons':11A 'run':18A 'sandbox':28A 'secur':7A 'sever':6A 'tech':35A 'vz46rd':37A 'without':19A 'zstd':10A","search_b":"'-202611':228B '/.env':116B '13':50B '2.1.321':225B '2.1.325':48B '2026':52B 'abl':169B 'ackg3u':229B 'advisori':218B 'allow':87B,205B 'allowedprovid':202B 'anthrop':44B 'appli':106B,128B 'approv':130B 'arriv':132B 'ask':82B,103B 'bash':78B,86B,109B,148B 'bedrock':193B,200B 'cd':124B 'certain':108B 'claud':46B,142B 'claude/settings.local.json':181B 'code':47B 'command':79B,110B,168B 'commit':180B 'compound':77B 'compress':64B 'control':145B 'convers':198B 'could':90B 'count':195B 'cover':119B 'cve':216B 'decod':67B 'deni':101B,112B,125B 'detail':71B 'differ':93B 'download':177B 'e.g':114B 'earli':41B 'early-warn':40B 'exploit':212B 'fix':75B,226B 'folder':166B,178B 'fulli':151B 'git':165B 'hook':158B 'host':139B 'issu':59B 'link':161B 'list':56B 'longer':118B 'name':99B 'nativ':174B 'note':55B 'nov':51B 'one':97B 'permiss':84B 'program':94B 'project':121B 'protect':152B 'read':115B 'relat':111B 'releas':45B,54B,74B 'remot':144B 'remote-control':143B 'respons':65B 'restart':135B 'rule':88B,104B,113B,126B 'run':80B,91B 'runner':140B 'sandbox':149B,167B 'secur':58B 'self':138B 'self-host':137B 'send':196B 'separ':222B 'session':146B 'set':156B 'share':164B 'subfold':191B 'tech':227B 'techniqu':43B 'token':194B 'treat':183B 'unknown':214B 'updat':175B 'user':186B 'warn':42B 'whether':207B 'without':81B 'worktre':154B,162B 'write':171B 'yet':219B 'zstd':63B 'zstd-compress':62B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T20:40:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-vz46rd","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T21:20:05+00:00","fetched_at":"2026-11-13T21:20:05+00:00","note":null}],"documents":[{"id":149629,"url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.325","title":"Claude Code releases: v2.1.325","kind":"release","source":"release","publisher":null,"text":"v2.1.325\n\nWhat's changed Fixed a security issue in how zstd-compressed responses are decoded Added a spinner tip in VS Code and similar integrated terminals about re-running a notebook cell, shown once Claude has read or edited a Jupyter notebook Added a line under the error shown when your organization's policy blocks a request, saying how to continue: run /rewind and change the message, or run /clear Added a note for Claude when a sandboxed git checkout , git stash or autostash pull cannot update protected files such as those in .claude Fixed /security-review and skills' inline git commands stopping with an error in worktrees of bare repositories, --separate-git-dir checkouts and Android repo checkouts Fixed subagents with their own model being moved to the plan-mode model when the model setting is opusplan or haiku Fixed subagents on a different model sizing file reads and MCP results with the main session's model Fixed sessions on many third-party gateways and Foundry stopping with a context length error on every turn instead of compacting Fixed recent turns sometimes going missing from a resumed session after Claude Code stopped without a clean exit Fixed shell commands running in the launch directory after the working directory was deleted; the command now fails with a message and can be re-issued Fixed an approved plan edit being lost when the plansDirectory folder can't take it: the plan is now saved in the default plans folder, and a warning says where and why Fixed a saved sonnet[1m] model setting being rewritten on a new install to a model id the API rejects Fixed focus view hiding the reply to your prompt when a scheduled task replied after it Fixed the prompt sometimes missing from a background subagent's view when fullscreen is off Fixed long options in lists and permission prompts being partly overwritten when they wrap, and first-run screens losing lines on narrow terminals Fixed startup warnings about permission rules and the \"N MCP servers need authentication\" notice being recorded as seen when they were scrolled out of view Fixed the welcome header showing control characters or splitting across lines when an agent's name or the working folder contains them or a line break Fixed the red error shown when Claude tries a command only you can run: a dim line now says it runs only when you type it at the prompt Fixed /stats showing an Active days total that was one day too high Fixed /insights saying a report was ready when no session qualified for analysis, and writing two values into its HTML report without escaping them Fixed /voice saying voice mode changed when managed settings, --settings , or the project's .claude/settings.json or .claude/settings.local.json kept it as it was; it now says what holds it Fixed the IDE welcome dialog showing Cmd+Esc for Quick Launch on Windows and Linux Fixed Slack app tips showing when your organization's policy denies cloud sessions Fixed claude purge hanging silently when there is no terminal to read keys from, and its project picker and -i prompts ignoring the keyboard when stdin is piped Fixed claude plugin eval --output-dir '' writing the report into the current folder; it now exits with an error Fixed claude -p text output on a terminal passing control sequences other than text styling; pipes and files are unchanged Fixed leftover .oauth_refresh.lock.owner.tmp.* files piling up in the config directory Fixed /fast saying \"Fast mode has been disabled by your organization\" under the keyless Console sign-in, where Claude Code had not asked the server Fixed /model saying that your organization restricts a model when Claude Code could not check that, for example with no network Fixed \"Sign in with your Console account\" in /login replacing your existing login when you pressed Esc right after the browser step Fixed the browser showing the sign-in success page in some cases where sign-in failed or was canceled Fixed claude auth status and other short commands leaving a lock behind on a Co","published_at":"2026-11-13T20:40:01+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}