CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK
Updated by Alex Sorokoletov
CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK is a Claude Code environment variable: Previously allowed disabling command injection detection. The safety check is now mandatory — no opt-out. This aligns with the changelog's hook hardening: compound commands and env-var prefixed commands are now properly matched by hook filters[1]. Removed between v2.1.88 and v2.1.89, so current releases ignore it. It is not in the official reference.
| Status | Removed between v2.1.88 and v2.1.89 |
|---|---|
| Added | Present since v2.1.69 or earlier |
| Category | Feature toggles |
| Official docs | Not listed |
How to set it
For one session, export it in the shell that starts Claude Code:
export CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK=<value>
claudeTo apply it to every session, add it to the env object of a settings file:
// ~/.claude/settings.json
{
"env": {
"CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK": "<value>"
}
}Release notes that mention it
- Claude Code v2.1.90 — 3 New Environment Variables: Anthropic AWS Provider, Marketplace Resilience, and /powerup Lessons
- Claude Code v2.1.89 — 4 New Environment Variables: Agent Cost Steering, Session Resume Controls, and 50% StructuredOutput Fix
- Claude Code Version Tracker: Undocumented Env Vars, Feature Gates & Models
- 83 Undocumented Claude Code Environment Variables (v2.1.19)
Related variables
CLAUDE_CODE_DISABLE_NOTIFICATION_PRESENCE_CHECKDISABLE_BUG_COMMAND: /bug command.DISABLE_DOCTOR_COMMAND: /doctor diagnostic command.DISABLE_EXTRA_USAGE_COMMAND: Extra usage display.DISABLE_FEEDBACK_COMMAND: /feedback command.DISABLE_INSTALL_GITHUB_APP_COMMAND: GitHub app install command.DISABLE_UPGRADE_COMMAND: /upgrade command.CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION
Frequently asked questions
What does CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK do?
Previously allowed disabling command injection detection. The safety check is now mandatory — no opt-out. This aligns with the changelog's hook hardening: compound commands and env-var prefixed commands are now properly matched by hook filters[1].
Which Claude Code version has CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK?
Removed between v2.1.88 and v2.1.89, so current releases ignore it.
How do I set CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK?
Export it before starting Claude Code (export CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK=value), or add it to the "env" object in ~/.claude/settings.json to apply it to every session.
All variables, searchable: Claude Code environment variables.