8.7High
CVE-2025-66032Claude Code Command Validation Bypass Allows Arbitrary Code Execution
Description
Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.
Weakness (CWE):
CWE-77
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| anthropic | claude code | < 1.0.93 | |
| anthropics | claude-code | < 1.0.93 |
References and patches
CPE matches (NVD) (1)
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*< 1.0.93