[Bug] Unsafe directory traversal attempt during /init - attempted parent directory access
Status Closed — not planned
Reported on v2.1.94
Maintainer reply None cached
Activity 6 comments · opened Apr 9, 2026 · closed May 23, 2026
Bug Description
upon /init Claude tried to break out of the D:/code-projects/ACCESS-API/ directory by executing Bash(ls -la "D:/code-projects") the behavior to try and access the parent directory is unsafe, the user had to manually deny the request
Environment Info
- Platform: win32
- Terminal: windows-terminal
- Version: 2.1.94
- Feedback ID: c6346a97-9dc7-49eb-acba-8eba803e7791
Errors
[]This issue has 6 comments on GitHub. Read the full discussion on GitHub ↗