SG-084: Deep-Link Settings Injection
Severity: CRITICAL
IDE / agent deep-link URLs (claude-cli://, cursor://, vscode://, windsurf://, codex://) carrying a `--settings=` / `settings=` / `hooks` / `command=` payload. This is the CVE-2025-59536 / CVE-2026-21852 attack vector (eager flag parser executes the settings JSON, including hooks, before the trust dialog).
Fires when
- An IDE/agent deep-link URL (claude-cli://, claude-code://, cursor://, vscode://, windsurf://, codex://) that ALSO carries a `--settings=` / `settings=` parameter or a string-encoded `hooks` object.
- Or that deep-link URL carries a `command=` running shell content (bash/sh/zsh/python/curl/wget/node).
- This is the CVE-2025-59536 / CVE-2026-21852 eager-flag-parser vector (settings JSON, including hooks, runs before the trust dialog).
Related CVEs
Remediation
Treat deep-link URLs (claude-cli://, cursor://, vscode://, windsurf://) in any project file as untrusted; never click such links from a README or other markdown. Update Claude Code to >= 2.1.118 (CVE-2025-59536 patch). If you must publish a launch link, use only the parameter-less form, never include `settings=`, `--settings=`, `hooks`, or `command=` in the URL.