grassplatypus

GitHub · Repository owner · Source ID 15873253
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

grassplatypus/cve-2026-45033-class

Repository PoC0Created 2026-08-04ExploitCVE-2026-4503322 files

33.8 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PoC exploit for CVE-2026-45033, adapted for Claude Code. It plants a malicious bare git repository with a core.fsmonitor config to achieve arbitrary code execution inside the agent's sandbox when git status runs. The README describes two bypasses of Claude Code's bash permission guard and provides scripts to build and run the exploit in a Docker container.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a container run script for a proof-of-concept demonstrating a git bare-repo / core.fsmonitor vulnerability against Claude Code. The PoC describes an inert payload that payload withheld and explicitly states it performs no network, file reads, or destructive actions. No concealed executable behavior, credential theft, persistence, or unrelated payload is present in the supplied text.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesbashmarkdown
Target softwareclaude codegit
Attack typesarbitrary code executioncommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is explicitly labeled as a 'Proof-of-concept' and describes code that plants a malicious git repository to achieve code execution when the agent runs git commands. The README details the exploitation mechanism and provides instructions to run the exploit, which is the primary purpose of the artifact.

README.md:1-10

Requirements

  • Requires a Claude Code agent session with authentication to run the live test.README.md:51-55
  • Requires Docker to build and run the containerized test environment.container/run.sh:1-104

Observed behavior

  • Creates a malicious bare git repository with core.fsmonitor set to an arbitrary command.README.md:3-6
  • Bypasses Claude Code's bash permission guard using symlink path-laundering or command-name gap techniques.README.md:20-30
  • Executes a payload (payload withheld) when the agent runs git status.README.md:8-10
  • Provides a Docker-based test bench to run the exploit against vulnerable and patched Claude Code versions.container/run.sh:1-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Behavior
Payload withheldThe README describes the payload as inert, writing only a timestamp marker file, with no network, file reads, or destructive action.README.md:9-10README.md:65-66
Disclosure
Payload withheldThe README explicitly states the PoC is defensive research and instructs users to test only against software and accounts they own.README.md:67-68
Review boundaries

What the analysis did not establish

  • Only 2 of 22 text files were included in the evidence; the actual exploit scripts (e.g., build.sh, verify.sh, malicious-repo contents) are not provided, so the analysis is based solely on the README and run.sh descriptions.
  • The evidence does not include the source code of the bypass or payload, only high-level descriptions of the techniques.
  • Only 2 of 22 text files in the repository were included in the evidence packet; 20 text files were omitted and not reviewed.
  • The evidence packet states binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.