[BUG] Heredoc pipe bypass still present in v2.1.141 (#48518 still not fixed)
Status Closed — not planned
Maintainer reply None cached
Activity 8 comments · opened May 14, 2026 · closed Jun 20, 2026
This is a continuation of issue #48518, which was locked but still reproduces as mentioned by @spawnia on v2.1.104 and potentially higher .
The fix introduced in v2.1.73 only fixed the CPU loop/freeze symptom, but the underlying permission bypass remains. When a heredoc marker (<<EOF or <<'EOF') is the first token after the command name, the permission system fails to evaluate pipe targets. An ask-listed command silently auto-allows when it appears after |.
Reproduction
Permissions:
{
"permissions": {
"allow": ["Bash(cat:*)", "Bash(sort:*)", "Bash(head:*)", "Bash(echo:*)"],
"ask": ["Bash(pandoc:*)", "Bash(curl:*)"]
}
}Auto-allowed (bug — ask rule on pipe target skipped):
cat <<'EOF' | pandoc --to=plain # heredoc first arg ✗This issue was previously verified as reproducing on v2.1.104 by @spawnia in #48518, but the issue was locked by a bot before it could be reopened.
8 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
This is not a duplicate, the other issues have been falsely marked as duplicated and this needs to be addressed!
@ashwin-ant
Thank you @Tarek98! My repeated reproduction in https://github.com/anthropics/claude-code/issues/48518#issuecomment-4287842491 was apparently overlooked or not tended to quickly enough. I hope someone from Anthropic can look into this soon and address this security bug. I am a bit skeptical of calling this a regression of https://github.com/anthropics/claude-code/issues/48518 - as far as I can tell, this issue always existed and was never implemented correctly or fixed.
Thanks @spawnia, I changed the title to say your issue was still not fixed instead of calling it a regression. I was too quick to generate this issue and hadn't noticed that title naming mistake, so sorry about that. Hoping someone from Anthropic can take a look soon too.
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
Tested on v2.1.193 (Linux/WSL2 Ubuntu 24.04).
With
cat:*inallowandpandoc:*inask, running:Claude Code required user approval before proceeding — the
askrule onpandocfired correctly. The command did not auto-allow silently.This suggests the bypass is fixed as of v2.1.193. Leaving this note here since the issue was closed for inactivity before the fix could be confirmed.
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.