Source Intelligence

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

All of v2.0.28 Home All releases olderv2.0.27 v2.0.29newer
Claude Code v2.0.28

Improved Path Traversal Detection

What: Enhanced security check now detects paths with 3+ consecutive dots (e.g., ..., ....) as suspicious Windows path patterns.

Why this matters: Attackers sometimes use unusual dot sequences to bypass basic .. filters. While ... isn't standard, blocking it prevents potential exploits in path normalization edge cases.

Details:

  • Adds regex check /\.{3,}/ to Windows path validation
  • Blocks paths like C:\Users\....\file.txt or path/to/.../folder
  • Triggers manual approval prompt: "contains a suspicious Windows path pattern"
  • Complements existing checks for reserved names, alternate data streams, and other Windows-specific attacks
  • Evidence: Modified function tf2() at line 465855 (renamed from mf2()); new check at line 465867

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.0.28 →