8.7Hoch
CVE-2025-66032Claude Code Command Validation Bypass Allows Arbitrary Code Execution
Beschreibung
Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.
Schwachstellentyp (CWE):
CWE-77
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| anthropic | claude code | < 1.0.93 | |
| anthropics | claude-code | < 1.0.93 |
Referenzen und Patches
CPE-Treffer (NVD) (1)
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*< 1.0.93