CLAUDE DESKTOP EXTENSIONS ZERO-CLICK RCE EXPOSES OVER 10K USERS TO SILENT ATTACKS

Summary from the TLDR InfoSec newsletter

Researchers at the security firm LayerX uncovered a critical (CVSS 10/10) vulnerability in Claude Desktop Extensions (DXT) that could enable remote code execution (RCE) with no user interaction. In the proof-of-concept disclosed by LayerX, an attacker would send the victim a Google Calendar invite containing malicious instructions in the event description. The victim would then, at some point, ask Claude to manage their calendar or check events, and the malicious instructions would be executed. This vulnerability is enabled by the fact that Claude DXT intentionally runs without any isolation.