Permission matching fails for commands using <<< (here-string) syntax
Resolved 💬 6 comments Opened Mar 22, 2026 by oameye Closed Apr 8, 2026
Description
Bash permission allowlist entries like Bash(cut:*), Bash(tr:*), Bash(uniq:*) fail to match when the command uses <<< (here-string) syntax, even though the command prefix is correct.
Steps to reproduce
- Add
Bash(cut:*)to permissions insettings.json - Run a command without
<<<:cut --help— auto-allowed - Run a command with
<<<:cut -d' ' -f1 <<< "hello world"— prompts for permission
Expected behavior
Both commands start with cut and should match Bash(cut:*).
Actual behavior
Only commands without <<< are matched. The here-string syntax causes the permission check to fail.
Affected commands
Any command using <<<, confirmed with cut, tr, and uniq. Piping via echo "..." | cut ... works as a workaround (matched by Bash(echo:*)).
This issue has 6 comments on GitHub. Read the full discussion on GitHub ↗