Bash Command Chaining Bypasses Safety Checks for Multi-Command Execution
Status Fixed / completed
Maintainer reply ✓ Yes — rboyce-ant
Activity 5 comments · opened Mar 7, 2025 · closed Jun 3, 2025
💡 Likely answer: A maintainer (rboyce-ant, contributor)
responded on this thread — see the highlighted reply below.
Bug Description
When Claude uses the Bash tool, it can execute multiple commands at the same time with &&, which can circumvent protections against dangerous command execution.
In my case, it was able to execute a commit message without my consent by doing
cd /my/path && git commit -m "blah"I think this is because I gave it permission to run cd commands freely in the session, and it saw the cd up front and allowed the entire command, even though it also included a git commit.
Obviously this is not so bad, but you can easily imagine scarier cases.
Environment Info
- Platform: macos
- Terminal: iTerm.app
- Version: 0.2.32
- Feedback ID: 465f7d0e-1427-41f4-b5c4-eff16337cc33
5 Comments
#389 is essentially saying the same thing.
Chaining needs to be disallowed except by required user review, and there needs to be a config setting to totally disallow it in a repository.
In order to prevent the need for chaining, I've set up my scripts to not need any
cd. I would appreciate it if Claude Code could understand never to propose those commands. More generally there are other commands that it would be safer to not propose as well. For instance, Claude proposed afindthat had a--deleteattached to it. I told it the command was too complicated and denied it.+1 to add that I've seen this issue with chained python commands as well.
!Image
This should be fixed consistently across all commands. Please file a new issue if you are seeing commands being chained incorrectly!
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.