Claude Code's bundled Bun 1.4.3 ships RCE flaw; update past 2.1.308
KyeGomezB · x · 2026-10-23
A PSA for AI agent users: Claude Code bundles its own Bun runtime, independent of your system's Node.js. Claude Code 2.1.296 was confirmed to ship Bun 1.4.3, which contains the newly disclosed Brotli remote code execution vulnerability.
Key points:
- Updating system Node.js does not fix the embedded Bun in Claude Code
- Context: the new Node.js RCE flaw lets attackers take over your machine — risky for anyone running web-browsing AI agents; patched Node versions are 22.23.4, 24.22.1, or 26.12.1+
- Check with claude --version — you need at least 2.1.308
- Fix: run claude update
More from coding & agent
- Streamline launches MCP connector for AI search and download of icons and illustrations — modelcontextprotocol · 2026-10-23
- PostgreSQL Query MCP Server lets Claude run read-only SQL via natural language — modelcontextprotocol · 2026-10-23
- Terminal-RSI lifts Qwen3.8-27B from 51.7% to 86.52% on Terminal-Bench, plus 70 tok/s on M5 Max via DFlash 2 — udmrzn · 2026-10-23
- mcp-overleaf: an open-source MCP server with 17 tools to stop AI from breaking your LaTeX — Rare-Raccoon-8997 · 2026-10-23
- NVIDIA Launches Verified Agent Skills to Bring Capability Governance to the Skill Layer — bradneuberg · 2026-10-23
- Cognition open-sources Devin agent plugin to patch the day's CVE wave — Scobleizer · 2026-10-23