anthropics claude-code vulnerabilities

Latest anthropics claude-code CVEs

Newest publication first · page 1 of 2

1. CVE-2026-88968 Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

   Published 2026-11-03

   High·CVSS 7.7 EPSS 0.32%

   Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically re...

2. CVE-2026-88066 Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable

   Published 2026-11-03

   High·CVSS 7.5 EPSS 0.29%

   Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened projec...

3. CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

   Published 2026-10-13

   High·CVSS 7.5 EPSS 0.20%

   Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin r...

4. CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

   Published 2026-06-29

   High·CVSS 7.7 EPSS 0.69%

   Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and g...

5. CVE-2026-46406 Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write

   Published 2026-06-29

   Medium·CVSS 4.4 EPSS 0.15%

   Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a wor...

6. CVE-2026-54316 Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

   Published 2026-06-23

   Medium·CVSS 6.0 EPSS 0.52%

   Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt...

7. CVE-2026-44470 Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService

   Published 2026-05-13

   High·CVSS 8.5 EPSS 0.16%

   The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real d...

8. CVE-2026-44467 Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

   Published 2026-05-13

   High·CVSS 7.4 EPSS 0.14%

   The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without compa...

9. CVE-2026-40068 Claude Code arbitrary code execution via git worktree commondir trust dialog bypass

   Published 2026-05-05

   High·CVSS 7.7 EPSS 0.31%

   In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted,...

10. CVE-2026-39861 Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

    Published 2026-04-21

    High·CVSS 7.7 EPSS 0.71%

    Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed proce...

11. CVE-2026-35603 Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

    Published 2026-04-17

    Medium·CVSS 5.4 EPSS 0.11%

    Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData direc...

12. CVE-2026-33068 Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

    Published 2026-03-20

    High·CVSS 7.7 EPSS 0.35%

    Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set p...

13. CVE-2026-25725 Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.53%

    Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/se...

14. CVE-2026-25724 Claude Code Has Permission Deny Bypass Through Symbolic Links

    Published 2026-02-06

    Low·CVSS 2.3 EPSS 0.48%

    Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code...

15. CVE-2026-25723 Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.39%

    Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories lik...

16. CVE-2026-25722 Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

    Published 2026-02-06

    High·CVSS 7.7 EPSS 0.51%

    Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypa...

17. CVE-2026-24887 Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

    Published 2026-02-03

    High·CVSS 7.7 EPSS 0.64%

    Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to...

18. CVE-2026-24053 Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

    Published 2026-02-03

    High·CVSS 7.7 EPSS 0.51%

    Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting...

19. CVE-2026-24052 Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

    Published 2026-02-03

    High·CVSS 7.1 EPSS 0.43%

    Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org,...

20. CVE-2026-21852 Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

    Published 2026-01-21

    Medium·CVSS 5.3 EPSS 27.5%

    Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings...

21. CVE-2025-66032 Claude Code Command Validation Bypass Allows Arbitrary Code Execution

    Published 2025-12-03

    High·CVSS 8.7 EPSS 0.74%

    Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability...

22. CVE-2025-64755 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

    Published 2025-11-21

    High·CVSS 8.7 EPSS 0.62%

    Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.

23. CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog

    Published 2025-11-19

    High·CVSS 7.7 EPSS 0.55%

    Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would h...

24. CVE-2025-59829 Claude Code: Permission deny bypass is possible through symlink

    Published 2025-10-03

    Low·CVSS 2.3 EPSS 0.45%

    Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Cod...

25. CVE-2025-59536 Claude Code's startup trust dialog could lead to Command Execution attack

    Published 2025-10-03

    High·CVSS 8.7 EPSS 25.2%

    Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.