
CVE-2026-45033 PoC for Claude Code, not Github Copilot. Worked for Haiku 4.5.
core.fsmonitor guard bypass (PoC)Proof-of-concept for the "malicious bare git repository → core.fsmonitor →
code execution" vulnerability class (cf. CVE-2026-45033 in GitHub Copilot CLI)
reproduced against Claude Code, defeating the extra bash permission guard
Claude Code added that Copilot did not have.
Result: code execution inside Claude Code's sandbox when the agent runs a
git command in a repo whose files were planted past the guard. Inert payload
(writes a timestamp to /tmp/.bench-marker).
Claude Code prompts before any single bash command that both creates
git-structure files (HEAD/objects/refs/hooks) and runs git:
"This command creates git repository structure files (HEAD/objects/refs/hooks) and then runs git, which can execute hooks/fsmonitor from the created files."
Two bypasses:
current/HEAD where current -> .. The
older guard resolves paths lexically and never sees HEAD. (Fixed by the
realpath change in the patched release.)mkdir/touch/mv/cp); /bin/mkdir, install, or a repo-shipped
binary is skipped. (Works on the patched release too.)Either way the project directory becomes a valid bare repo whose
core.fsmonitor fires on the next git status.
Two pieces:
container/ two Claude Code versions side by side, auto-updater disabled
malicious-repo/ a plausible monorepo that carries the injection
Environment sanity check (no agent, proves the mechanism):
cd malicious-repo
./build.sh
./verify.sh # clones fresh, runs the planted command, asserts fsmonitor fired
Live test against real Claude Code:
cd container
./build.sh # builds an image with both the vulnerable and patched versions
./run.sh login # one-time sign-in (shared across versions)
./run.sh # drops you in the malicious checkout; run claude and follow the prompt
See malicious-repo/RUNBOOK.md for the step-by-step live procedure and the
expected differential between the two versions.
$HOME./tmp/.bench-marker, nothing else. No
network, no file reads, no destructive action.