CVE-2026-79623: FishCodeTech Muteki RCE Vulnerability

CVE-2026-79623 Overview

CVE-2026-79623 is an OS command injection vulnerability in FishCodeTech Muteki versions up to 0.2.5. The flaw resides in an unknown function within the .claude/settings.json file of the Default Local Worker Backend component. An attacker with low privileges can manipulate this configuration to inject and execute arbitrary operating system commands. The attack is initiated remotely over the network, and a public exploit disclosure has been published. The maintainer closed the corresponding issue with a note indicating that the project will be refactored and shut down, meaning no upstream fix is planned.

Critical Impact
Authenticated remote attackers can inject arbitrary OS commands through the Muteki local worker backend configuration, and no vendor patch is planned.

Affected Products

FishCodeTech Muteki versions up to and including 0.2.5
Default Local Worker Backend component
Deployments relying on the .claude/settings.json configuration file

Discovery Timeline

2026-08-25 - CVE-2026-79623 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79623

Vulnerability Analysis

The vulnerability is classified as OS Command Injection under CWE-77: Improper Neutralization of Special Elements Used in a Command. Muteki's Default Local Worker Backend processes values sourced from the .claude/settings.json configuration file without adequate sanitization before passing them to an operating system command interpreter. An attacker who can influence this file, or the fields it feeds into command construction, can append shell metacharacters and chain arbitrary commands.

Because the attack is reachable over the network and requires only low-level authentication, exploitation is well suited to lateral movement scenarios where an attacker has already obtained limited access. Public disclosure of the exploitation technique through the Muteki Vulnerability Report and VulDB CVE-2026-79623 lowers the barrier to weaponization.

Root Cause

The root cause is the direct concatenation or interpolation of untrusted string values from .claude/settings.json into shell command invocations executed by the local worker backend. The code path lacks input validation, argument arrays, or safe process spawning primitives that would prevent shell metacharacter interpretation.

Attack Vector

A remote authenticated attacker submits crafted content that lands in the .claude/settings.json file consumed by the worker backend. When the backend reads the tainted field and constructs a command string, injected metacharacters (for example ;, &&, or backticks) cause the shell to execute attacker-supplied commands with the privileges of the worker process. See the GitHub Issue #7 for Muteki for the maintainer's disclosure and shutdown notice.

No verified proof-of-concept code is reproduced here. Refer to the referenced advisory sources for technical exploitation details.

Detection Methods for CVE-2026-79623

Indicators of Compromise

Unexpected modifications or writes to .claude/settings.json on hosts running Muteki
Muteki worker backend processes spawning shells (sh, bash, cmd.exe) or utilities such as curl, wget, or nc
Outbound network connections from the Muteki worker service to unknown or non-corporate destinations

Detection Strategies

Monitor process lineage for the Muteki worker binary spawning child shell interpreters or command-line utilities
Enable file integrity monitoring on .claude/settings.json and alert on writes from non-administrative accounts
Inspect worker backend logs for malformed or shell-metacharacter-laden configuration values

Monitoring Recommendations

Baseline normal command execution behavior of the Muteki worker service and alert on deviations
Forward host telemetry and process events to a centralized analytics platform for correlation
Track authenticated API access to Muteki endpoints, especially configuration write operations

How to Mitigate CVE-2026-79623

Immediate Actions Required

Inventory all systems running FishCodeTech Muteki 0.2.5 or earlier and isolate them from untrusted networks
Restrict authenticated access to the Muteki instance to a minimal set of trusted operator accounts
Apply strict file permissions on .claude/settings.json so only privileged service accounts can modify it
Plan migration off Muteki given the maintainer's stated intent to shut down the project

Patch Information

No vendor patch is available. The maintainer closed GitHub Issue #7 for Muteki with a comment stating the project will be refactored and shut down. Refer to the GitHub Project Muteki repository and the VulDB Vulnerability #394962 entry for the current status.

Workarounds

Run the Muteki worker as a least-privileged, non-root user within a container or sandbox
Block network reachability to Muteki management interfaces from untrusted zones using host or network firewalls
Sanitize or validate any automation writing to .claude/settings.json to reject shell metacharacters
Decommission Muteki deployments and migrate workloads to a supported alternative

bash

# Configuration example: restrict access to the vulnerable settings file
chown root:muteki /path/to/.claude/settings.json
chmod 640 /path/to/.claude/settings.json

# Restrict network exposure of the local worker backend
iptables -A INPUT -p tcp --dport <muteki_port> -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <muteki_port> -j DROP