A zsh permission-check bypass in Claude Code let hidden commands execute inside `[[ ]]` regex conditionals — patched August 4
The same 2.1.221 release fixes a Bash tool permission-check bypass in which zsh could execute hidden commands embedded in `[[ ]]` regex conditionals, meaning the approval prompt never fired for the smuggled command; those now prompt. A companion fix covers PowerShell permission checks mishandling paths containing quote characters on Windows, which likewise now prompt for approval. Both are worth reading as a class rather than two bugs: any permission layer that parses a shell command string rather than intercepting execution inherits the full ambiguity of that shell's grammar, so if you build your own allowlists or hooks around agent shell access, assume string-level parsing is bypassable and pin your CLI to a patched version.
↳ Follow the thread