SG-058: Hook Config Lifecycle RCE
Severity: CRITICAL
Hook lifecycle entry running shell, interpreter, or fetch-and-exec
Fires when
- A settings.json hook lifecycle entry runs a remote fetch-and-exec command (curl|sh, base64 -d|sh) - CRITICAL, the CVE-2025-59536 shape.
- A SessionStart / UserPromptSubmit auto-exec hook runs a command from a suspicious location (temp dir, decoded artifact, stripped-quarantine binary) before any user prompt - HIGH.
- In-repo hook scripts (.claude/hooks/, $CLAUDE_PROJECT_DIR) and known formatters (prettier/eslint/black/ruff, ...) are exempt.
Related CVEs
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.