Anthropic vulnerabilities

Products

• claude code 26
• @anthropic-ai/claude-code 2
• claude desktop 2
• claude sdk for python 2
• claude sdk for typescript 2
• bun 1
• claude 1
• Claude Desktop - Windows 1
• Claude Desktop Cowork 1
• Slack MCP Server 1

Latest Anthropic CVEs

Newest publication first · page 1 of 2

1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

   Published 2026-10-22

   Critical·CVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

2. CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

   Published 2026-10-07

   High·CVSS 7.7 EPSS 0.25%

   Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the...

3. CVE-2026-103012 claude-code: claude-code: Security policy bypass via improper credential prioritization

   Published 2026-09-30

   Low·CVSS 2.0 EPSS 0.11%

   Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself...

4. CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

   Published 2026-06-29

   High·CVSS 7.7 EPSS 0.69%

   Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and g...

5. CVE-2026-46406 Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write

   Published 2026-06-29

   Medium·CVSS 4.4 EPSS 0.15%

   Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a wor...

6. CVE-2026-7574 Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

   Published 2026-06-23

   High·CVSS 8.7 EPSS 0.11%

   Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image content integrity at time-...

7. CVE-2026-54316 Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

   Published 2026-06-23

   Medium·CVSS 6.0 EPSS 0.52%

   Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt...

8. CVE-2026-44470 Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService

   Published 2026-05-13

   High·CVSS 8.5 EPSS 0.16%

   The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real d...

9. CVE-2026-44467 Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

   Published 2026-05-13

   High·CVSS 7.4 EPSS 0.14%

   The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without compa...

10. CVE-2026-40068 Claude Code arbitrary code execution via git worktree commondir trust dialog bypass

    Published 2026-05-05

    High·CVSS 7.7 EPSS 0.31%

    In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted,...

11. CVE-2026-41686 Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

    Published 2026-05-04

    Medium·CVSS 4.8 EPSS 0.12%

    Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node....

12. CVE-2026-39861 Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

    Published 2026-04-21

    High·CVSS 7.7 EPSS 0.71%

    Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed proce...

13. CVE-2026-35603 Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

    Published 2026-04-17

    Medium·CVSS 5.4 EPSS 0.11%

    Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData direc...

14. CVE-2026-34451 Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

    Published 2026-03-31

    Medium·CVSS 6.3 EPSS 0.36%

    Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix...

15. CVE-2026-34450 Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool

    Published 2026-03-31

    Medium·CVSS 4.8 EPSS 0.13%

    The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a sta...

16. CVE-2026-34452 Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape

    Published 2026-03-31

    Medium·CVSS 5.8 EPSS 0.14%

    The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory director...

17. CVE-2026-22561 Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer...

    Published 2026-03-31

    Medium·CVSS 4.7 EPSS 0.18%

    Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enab...

18. CVE-2026-33068 Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

    Published 2026-03-20

    High·CVSS 7.7 EPSS 0.35%

    Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set p...

19. CVE-2026-25725 Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.53%

    Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/se...

20. CVE-2026-25724 Claude Code Has Permission Deny Bypass Through Symbolic Links

    Published 2026-02-06

    Low·CVSS 2.3 EPSS 0.48%

    Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code...

21. CVE-2026-25723 Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.39%

    Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories lik...

22. CVE-2026-25722 Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.51%

    Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypa...

23. CVE-2026-24887 Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

    Published 2026-02-03

    High·CVSS 7.7 EPSS 0.64%

    Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to...

24. CVE-2026-24053 Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

    Published 2026-02-03

    High·CVSS 7.7 EPSS 0.51%

    Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting...

25. CVE-2026-24052 Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

    Published 2026-02-03

    High·CVSS 7.1 EPSS 0.43%

    Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.