8.7Alta
CVE-2025-66032Claude Code Command Validation Bypass Allows Arbitrary Code Execution
Descripción
Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.
Debilidad (CWE):
CWE-77
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| anthropic | claude code | < 1.0.93 | |
| anthropics | claude-code | < 1.0.93 |
Referencias y parches
Coincidencias CPE (NVD) (1)
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*< 1.0.93