GHSA-g3xq-3gmv-qq8g is a high-severity (CVSS 7.8) remote code execution vulnerability in claude-code-cache-fix. O3 Security confirms whether GHSA-g3xq-3gmv-qq8g is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Real-World Exposure
claude-code-cache-fixReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Summary
tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process.
Affected versions
- v3.5.0
- v3.5.1
Patched versions
- v3.5.2
Affected configurations
Users who wired tools/quota-statusline.sh into Claude Code's statusLine configuration. The v3.5.0 README explicitly recommends this setup, so most users on v3.5.0/v3.5.1 with the recommended setup are affected.
Attack chain
Claude Code's statusline hook payload reflects user-controlled paths (cwd, workspace.current_dir, workspace.project_dir, transcript_path). Apostrophes are legal in POSIX filesystem paths.
- A hostile directory name containing
'''+payload+'''lands on disk via any normal vector —git clone, archive extraction, npm package, downloaded zip, etc. - The victim has the recommended
tools/quota-statusline.shwired into their CCstatusLineconfig. - The victim
cds anywhere a hostile path is reachable. - CC fires the statusline hook on every redraw. The Python literal closes early. The injected bytes execute as Python in the user's process.
Severity
Local code execution at user privilege. Persistent re-fire on every statusline redraw. No user interaction beyond cd-ing into the hostile path. The user's shell, CC session, files, SSH keys, and any locally-accessible credentials are reachable from the executed code.
Vulnerable pattern
input=$(cat)
result=$(python3 -c "
stdin_data = json.loads('''$input''') if '''$input''' else {}
")
Fix
Capture stdin in bash, export to env, and pipe the Python source through a single-quoted heredoc (<<'PYEOF'). Single-quoting disables ALL bash interpolation inside the body. Python reads the JSON via os.environ.get('CC_INPUT'), where the bytes are inert at every layer.
CC_INPUT=$(cat)
export CC_INPUT
python3 <<'PYEOF' 2>/dev/null
import os, json
try:
cc_input = json.loads(os.environ.get('CC_INPUT') or '{}')
except Exception:
cc_input = {}
# ...
PYEOF
Workarounds
Until upgrading to v3.5.2:
- Disable the statusline by removing the
statusLineentry from~/.claude/settings.json, or - Replace
tools/quota-statusline.shwith a script that does NOT pass stdin throughpython3 -c "..."(a heredoc + env var rewrite is safe)
Credit
Reported by Jakob Linke (@schuay) via GitHub issue #108.
Timeline
- 2026-05-07 — reported (#108)
- 2026-05-07 — confirmed, fix implemented (#110)
- 2026-05-07 — v3.5.2 published
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | claude-code-cache-fix | ≥ 3.5.0&&< 3.5.2 | 3.5.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for claude-code-cache-fix. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update claude-code-cache-fix to 3.5.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g3xq-3gmv-qq8g is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-g3xq-3gmv-qq8g is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-g3xq-3gmv-qq8g. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-g3xq-3gmv-qq8g in your dependencies?
O3 detects GHSA-g3xq-3gmv-qq8g across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.