diff --git a/src/plugin/tool-execute-before.ts b/src/plugin/tool-execute-before.ts
index e5aad89a0..c46a28525 100644
--- a/src/plugin/tool-execute-before.ts
+++ b/src/plugin/tool-execute-before.ts
@@ -41,6 +41,16 @@ export function createToolExecuteBeforeHandler(args: {
   }
 
   return async (input, output): Promise<void> => {
+    if (input.tool.toLowerCase() === "bash" && typeof output.args.command === "string") {
+      if (output.args.command.includes("\x00")) {
+        output.args.command = output.args.command.replace(/\x00/g, "")
+        log("[tool-execute-before] Stripped null bytes from bash command", {
+          sessionID: input.sessionID,
+          callID: input.callID,
+        })
+      }
+    }
+
     await hooks.writeExistingFileGuard?.["tool.execute.before"]?.(input, output)
     await hooks.questionLabelTruncator?.["tool.execute.before"]?.(input, output)
     await hooks.claudeCodeHooks?.["tool.execute.before"]?.(input, output)