CVE-2025-66032: @anthropic-ai/claude-code Command Validation Bypass Leading to Arbitrary Code Execution
Summary
CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code Execution. Affects @anthropic-ai/claude-code versions < 1.0.93. Fixed in 1.0.93. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @anthropic-ai/claude-code package is a tool designed for developers to create and manage code in a collaborative environment. It offers features such as real-time code execution, version control, and integration with various development tools. However, due to its reliance on shell commands for execution, it is susceptible to command injection vulnerabilities, particularly in how it handles input parsing.
Vulnerability Detail
The vulnerability arises from improper parsing of shell commands related to the Internal Field Separator (IFS) and short command-line flags. This flaw allows an attacker to bypass the read-only validation mechanisms of Claude Code, enabling them to execute arbitrary code within the application context. Exploiting this vulnerability requires the attacker to introduce untrusted content into a Claude Code context window, which can lead to severe security breaches, including unauthorized access to system resources and data manipulation.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.93
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@1.0.93Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than updating to the patched version. It is advisable to avoid using untrusted content in the Claude Code context window until the update is applied.
Conclusion
In summary, CVE-2025-66032 is a significant vulnerability in the @anthropic-ai/claude-code package that allows for command validation bypass, leading to arbitrary code execution. Users are strongly advised to update to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2025-66032 is a vulnerability in the @anthropic-ai/claude-code package that allows for command validation bypass, leading to arbitrary code execution.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If you cannot update the package right away, avoid using untrusted content in the Claude Code context window to mitigate the risk of exploitation.
The vulnerability was reported by RyotaK from GMO Flatt Security Inc.
Exploiting this vulnerability can lead to unauthorized code execution, data breaches, and potential compromise of system integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
