CVE-2025-55284: Unauthorized File Read and Network Exfiltration in @anthropic-ai/claude-code
Summary
CVE-2025-55284: Due to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Affects @anthropic-ai/claude-code versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @anthropic-ai/claude-code package is a tool designed to facilitate interactions with Claude AI, enabling users to write and execute code in a conversational manner. It provides a user-friendly interface for developers to leverage AI capabilities in their applications. However, due to an overly permissive default allowlist of commands, the package has become vulnerable to unauthorized file reading and potential data exfiltration.
Vulnerability Detail
The vulnerability arises from an overly broad allowlist of safe commands within the Claude Code context. This flaw allows an attacker to bypass confirmation prompts, enabling them to read files and transmit their contents over the network without user consent. Exploiting this vulnerability reliably requires the ability to introduce untrusted content into the Claude Code context window, which could lead to significant data breaches and unauthorized access to sensitive information.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.4
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@1.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to update to the patched version as soon as possible to mitigate risks.
Conclusion
The CVE-2025-55284 vulnerability in the @anthropic-ai/claude-code package highlights the importance of maintaining strict command allowlists to prevent unauthorized access. Users are strongly encouraged to update to version 1.0.4 or later to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2025-55284 is a vulnerability in the @anthropic-ai/claude-code package that allows unauthorized file reading and network exfiltration due to an overly permissive command allowlist.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to ensure security.
The vulnerability was reported by a user on HackerOne, specifically by the user 'wunderwuzzi23'.
Exploiting this vulnerability could lead to unauthorized access to sensitive files and data exfiltration, posing significant risks to user privacy and data security.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
