Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-45033-class — CVE-2026-45033 PoC for Claude Code, not Github Copilot. Worked for Haiku 4.5. | Kitploit
Tools/GitHubGitHub/grassplatypus/cve-2026-45033-class
Vulnerability AnalysisExploitationPenetration TestingSupply Chain SecurityRed TeamingAI Security
GitHubgrassplatypus/cve-2026-45033-class

cve-2026-45033-class

CVE-2026-45033 PoC for Claude Code, not Github Copilot. Worked for Haiku 4.5.

View Repository
51 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Claude Code — git bare-repo / core.fsmonitor guard bypass (PoC)

Proof-of-concept for the "malicious bare git repository → core.fsmonitor → code execution" vulnerability class (cf. CVE-2026-45033 in GitHub Copilot CLI) reproduced against Claude Code, defeating the extra bash permission guard Claude Code added that Copilot did not have.

Result: code execution inside Claude Code's sandbox when the agent runs a git command in a repo whose files were planted past the guard. Inert payload (writes a timestamp to /tmp/.bench-marker).

The guard and the bypass

Claude Code prompts before any single bash command that both creates git-structure files (HEAD/objects/refs/hooks) and runs git:

"This command creates git repository structure files (HEAD/objects/refs/hooks) and then runs git, which can execute hooks/fsmonitor from the created files."

Two bypasses:

  1. Symlink path-laundering — write current/HEAD where current -> .. The older guard resolves paths lexically and never sees HEAD. (Fixed by the realpath change in the patched release.)
  2. Command-name gap — the guard only path-checks a hardcoded set (mkdir/touch/mv/cp); /bin/mkdir, install, or a repo-shipped binary is skipped. (Works on the patched release too.)

Either way the project directory becomes a valid bare repo whose core.fsmonitor fires on the next git status.

Run it

Two pieces:

root@kitploit:~
container/        two Claude Code versions side by side, auto-updater disabled
malicious-repo/   a plausible monorepo that carries the injection

Environment sanity check (no agent, proves the mechanism):

root@kitploit:~
cd malicious-repo
./build.sh
./verify.sh          # clones fresh, runs the planted command, asserts fsmonitor fired

Live test against real Claude Code:

root@kitploit:~
cd container
./build.sh           # builds an image with both the vulnerable and patched versions
./run.sh login       # one-time sign-in (shared across versions)
./run.sh             # drops you in the malicious checkout; run  claude  and follow the prompt

See malicious-repo/RUNBOOK.md for the step-by-step live procedure and the expected differential between the two versions.

Notes

  • In-sandbox execution, not a sandbox escape. The Linux sandbox (bwrap) is read-only except the project dir, so the payload cannot reach $HOME.
  • Payload is inert — a timestamp to /tmp/.bench-marker, nothing else. No network, no file reads, no destructive action.
  • Test only against software and accounts you own. This is defensive research material; use it to understand and verify the fix.
Download Tool