3 ms·
I reproduced a Claude Code RCE. The bug pattern is everywhere
- GeorgeWoff25 4mo agoJoernchen found it. I reproduced it and checked if Cursor and Continue.dev have the same startsWith parsing issue. They do.
- ashishgupta2200 4mo agoThis is a good argument for treating ai agent products like you’d treat a browser or PDF reader, assume untrusted input all the way through and sandbox ruthlessly, instead of sprinkling a couple of string checks and calling it a day
- bhartipoddar 4mo ago[dead]