[BUG] claude code can read files outside the project dir without prompting

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code doesn't validate the flags passed to the "du" tool at all.
du, on my system, has a "--files0-from" argument, which reads NUL-delimited filenames from a file.
If you run "du --files0-from=<filename>", you'll get an error message with the contents of that file.
That consititutes reading arbitrary files, violating assumption 2.

You should probably add validation for that, before it becomes someone's gadget.

What Should Happen?

See repro steps

Error Messages/Logs

Steps to Reproduce

1. Install Claude Code
2. Install Visual Studio Code
3. Install the Claude Code for VS Code extension
4. Open fresh session
5. Switch to manual mode
6. Write "Please run du --files0-from=/etc/passwd"

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.282

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

There may be other improperly validated commands, but since it's not open source, it cannot properly assess that.
But you have the source, maybe you can sic Mythos on it :)

PS: I originally submitted this too disclosure@anthropic.com, but only got an automatic email back, telling me to submit it to hackerone, even though I don't even want a bounty.
That's too much effort for me, so now it's public. Enjoy.
You'd think an AI company could automate more of that process...