{"kind": "product", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "name": "@anthropic-ai/claude-code", "product": "@anthropic-ai/claude-code", "ecosystem": "npm", "items": [{"id": "CVE-2026-86063", "noindex": false, "published": "2026-10-13T19:04:11.695Z", "modified": "2026-10-13T20:21:00.156Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-86063", "title": "Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning", "description": "Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv", "https://github.com/anthropics/claude-code/releases/tag/v2.1.179", "https://nvd.nist.gov/vuln/detail/CVE-2026-86063"], "fixes": ["2.1.179"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-55607", "noindex": false, "published": "2026-06-29T14:04:00.693Z", "modified": "2026-06-29T15:51:30.130Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00687, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-55607", "title": "Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution", "description": "Claude Code is an agentic coding tool.  From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named \".git\" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fix", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv", "https://nvd.nist.gov/vuln/detail/CVE-2026-55607"], "fixes": ["2.1.163"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-46406", "noindex": false, "published": "2026-06-29T14:03:14.683Z", "modified": "2026-06-29T15:26:11.153Z", "cvss": 4.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46406", "title": "Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write", "description": "Claude Code is an agentic coding tool.  From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2", "https://nvd.nist.gov/vuln/detail/CVE-2026-46406"], "fixes": ["2.1.128"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-54316", "noindex": false, "published": "2026-06-23T17:06:16.184Z", "modified": "2026-06-23T17:37:38.468Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0052, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54316", "title": "Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch", "description": "Claude Code is an agentic coding tool.  From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Cl", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm", "https://nvd.nist.gov/vuln/detail/CVE-2026-54316"], "fixes": ["2.1.163"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-40068", "noindex": false, "published": "2026-05-05T20:52:26.089Z", "modified": "2026-05-06T15:24:52.454Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00314, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-40068", "title": "Claude Code arbitrary code execution via git worktree commondir trust dialog bypass", "description": "In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-q5hj-mxqh-vv77", "https://nvd.nist.gov/vuln/detail/CVE-2026-40068"], "fixes": ["2.1.84"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-39861", "noindex": false, "published": "2026-04-21T00:56:39.062Z", "modified": "2026-04-21T13:44:49.618Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00711, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-39861", "title": "Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "description": "Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp", "https://nvd.nist.gov/vuln/detail/CVE-2026-39861"], "fixes": ["2.1.64"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-35603", "noindex": false, "published": "2026-04-17T20:38:49.901Z", "modified": "2026-04-20T14:57:47.669Z", "cvss": 5.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00108, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35603", "title": "Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows", "description": "Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\\ProgramData\\ClaudeCode\\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine. Exploiting this would have required a shared multi-u", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx", "https://nvd.nist.gov/vuln/detail/CVE-2026-35603"], "fixes": ["2.1.75"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-33068", "noindex": false, "published": "2026-03-20T08:17:47.794Z", "modified": "2026-03-20T13:48:36.014Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00344, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-33068", "title": "Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File", "description": "Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent. This issue h", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7", "https://nvd.nist.gov/vuln/detail/CVE-2026-33068"], "fixes": ["2.1.53"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-25725", "noindex": false, "published": "2026-02-06T17:53:42.543Z", "modified": "2026-02-06T19:15:02.998Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00537, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25725", "title": "Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json", "description": "Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-ff64-7w26-62rf", "https://nvd.nist.gov/vuln/detail/CVE-2026-25725"], "fixes": ["2.1.2"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-25724", "noindex": false, "published": "2026-02-06T17:53:16.004Z", "modified": "2026-03-27T21:11:36.820Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00465, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25724", "title": "Claude Code Has Permission Deny Bypass Through Symbolic Links", "description": "Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-4q92-rfm6-2cqx", "https://www.terra.security/blog/when-ai-becomes-the-attack-surface-lessons-from-discovering-cve-2026-25724", "https://nvd.nist.gov/vuln/detail/CVE-2026-25724"], "fixes": ["2.1.7"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-25723", "noindex": false, "published": "2026-02-06T17:52:59.028Z", "modified": "2026-02-06T18:40:54.158Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25723", "title": "Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Exploiting this required the ability to execute commands through Claude Code with the \"accept edits\" feature enabled. This issue has been patched in version 2.0.55.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-mhg7-666j-cqg4", "https://nvd.nist.gov/vuln/detail/CVE-2026-25723"], "fixes": ["2.0.55"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-25722", "noindex": false, "published": "2026-02-06T17:52:42.069Z", "modified": "2026-02-06T18:42:01.040Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00517, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25722", "title": "Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh", "https://nvd.nist.gov/vuln/detail/CVE-2026-25722"], "fixes": ["2.0.57"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-24887", "noindex": false, "published": "2026-02-03T20:50:25.263Z", "modified": "2026-02-03T21:19:42.986Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00652, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-24887", "title": "Claude Code has a Command Injection in find Command Bypasses User Approval Prompt", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.72.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-qgqw-h4xq-7w8w", "https://nvd.nist.gov/vuln/detail/CVE-2026-24887"], "fixes": ["2.0.72"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-24053", "noindex": false, "published": "2026-02-03T20:49:59.261Z", "modified": "2026-02-03T21:22:27.265Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00522, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-24053", "title": "Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r", "https://nvd.nist.gov/vuln/detail/CVE-2026-24053"], "fixes": ["2.0.74"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-24052", "noindex": false, "published": "2026-02-03T20:49:41.997Z", "modified": "2026-02-04T20:00:11.786Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00439, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-24052", "title": "Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains", "description": "Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-vhw5-3g5m-8ggf", "https://nvd.nist.gov/vuln/detail/CVE-2026-24052"], "fixes": ["1.0.111"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2026-21852", "noindex": false, "published": "2026-01-21T20:42:06.812Z", "modified": "2026-01-21T21:34:43.858Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.27504, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-21852", "title": "Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advi", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7", "https://nvd.nist.gov/vuln/detail/CVE-2026-21852"], "fixes": ["2.0.65"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2025-66032", "noindex": false, "published": "2025-12-03T18:16:54.335Z", "modified": "2025-12-03T19:11:39.067Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00688, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-66032", "title": "Claude Code Command Validation Bypass Allows Arbitrary Code Execution", "description": "Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3", "https://nvd.nist.gov/vuln/detail/CVE-2025-66032"], "fixes": ["1.0.93"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2025-64755", "noindex": false, "published": "2025-11-21T01:13:05.579Z", "modified": "2025-11-24T18:13:06.459Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0062, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-64755", "title": "@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes", "description": "Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-7mv8-j34q-vp7q", "https://nvd.nist.gov/vuln/detail/CVE-2025-64755"], "fixes": ["2.0.31"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2025-65099", "noindex": false, "published": "2025-11-19T17:35:17.349Z", "modified": "2025-11-20T14:20:44.499Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00545, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-65099", "title": "Claude Code vulnerable to command execution prior to startup trust dialog", "description": "Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-5hhx-v7f6-x7gv", "https://nvd.nist.gov/vuln/detail/CVE-2025-65099"], "fixes": ["1.0.39"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}, {"id": "CVE-2025-59829", "noindex": false, "published": "2025-10-03T20:03:02.999Z", "modified": "2025-10-03T20:45:39.617Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00447, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-59829", "title": "Claude Code: Permission deny bypass is possible through symlink", "description": "Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120.", "references": ["https://github.com/anthropics/claude-code/security/advisories/GHSA-66m2-gx93-v996", "https://nvd.nist.gov/vuln/detail/CVE-2025-59829"], "fixes": ["1.0.120"], "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}]}], "total": 29, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@anthropic-ai/claude-code", "path": "vulns/npm/@anthropic-ai%2Fclaude-code", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-13T20:21:00.156Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}