提出 #887095: FishCodeTech Muteki v0.2.5 OS Command Injection

Muteki 0.2.5, tested at commit a585a29, is affected by unsafe project-level configuration injection when using its default local worker backend with Claude Code workers.

Muteki stages user-supplied CTF attachments inside a worker directory. An attacker- controlled archive can contain a .claude/settings.json file defining a Claude Code SessionStart hook. Because the default worker mode launches the Claude CLI as a host subprocess from the polluted worker directory, a subsequent headless Claude Code invocation loads the project-level configuration and executes the attacker-controlled hook on the host with the privileges of the Muteki user.

The issue was reproduced in an authorized local environment. A crafted tar.gz attachment containing .claude/settings.json was uploaded to Muteki. The worker extracted or accessed the attachment in its working directory and subsequently started a fresh Claude Code headless session. The SessionStart hook executed and established a reverse shell to an authorized local listener.

The confirmed vulnerable configuration was:
- Muteki 0.2.5, commit a585a29
- Claude Code worker
- Network access enabled
- Local worker backend, which is the default and runs the worker as a host subprocess

The issue did not reproduce when the container-isolated worker backend was enabled.Therefore, this report does not claim a container escape or isolation bypass.

The vulnerability is configuration-plane pollution: untrusted attachment content is able to introduce a trusted executable project configuration file, .claude/settings.json, into the execution context of a privileged downstream CLI. Successful exploitation requires the attachment to be processed and a fresh Claude Code session to be started from the polluted directory.

Impact includes arbitrary command execution with the privileges of the Muteki host user,access to files and credentials available to that user, modification of local data, and outbound network access permitted to the worker.

The vulnerability has also been privately reported to the FishCodeTech/muteki maintainers through a GitHub Private Security Advisory. No CVE has been assigned or reserved at the time of this submission. Please coordinate CVE assignment to avoid duplication.

• ソース: ⚠️ https://github.com/FishCodeTech/muteki/issues/7
• ユーザー: micr0softDl (UID 99693)
• 送信: 2026年07月12日 16:27 (1 月 ago)
• モデレーション: 2026年08月25日 10:42 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 394962 [FishCodeTech Muteki 迄 0.2.5 Default Local Worker Backend .claude/settings.json 特権昇格]
• ポイント: 20