AIKIDO-2026-10821

TL;DR

Early startup merges settings by scanning raw argv for tokens that begin with the settings flag prefix, without fully respecting which argv slots are real flags versus values of other options. A crafted claude-cli deep link can embed that prefix inside the prefill payload so JSON settings are loaded from an argument that belongs to --prefill instead of an intentional settings flag. Malicious settings can define hooks that execute shell commands when a session starts, yielding attacker-controlled code execution on the machine that runs the tool. The fix ensures settings flags are not parsed from nested option arguments so this injection path is closed.