CVE-2026-25722: Command Injection Vulnerability in @anthropic-ai/claude-code Allows Bypass of Write Protection
Summary
CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection. Affects @anthropic-ai/claude-code versions < 2.0.57. Fixed in 2.0.57. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is an advanced coding assistant developed by Anthropic AI, designed to facilitate coding tasks through intelligent suggestions and automation. It integrates seamlessly with various development environments, providing users with enhanced productivity. However, a recent vulnerability has been identified that compromises its security, specifically regarding directory changes and write operations.
Vulnerability Detail
The vulnerability arises from Claude Code's inadequate validation of directory changes when executing write operations in protected folders. By using the 'cd' command to navigate into sensitive directories, such as '.claude', an attacker can bypass the intended write protection. This allows unauthorized creation or modification of files without user consent. Exploiting this vulnerability requires the ability to introduce untrusted content into a Claude Code context window, posing significant risks to user data integrity and confidentiality.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.57
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.0.57Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the 'cd' command to navigate into sensitive directories while using Claude Code until the package is updated.
Conclusion
The CVE-2026-25722 vulnerability in the @anthropic-ai/claude-code package poses a significant risk by allowing command injection that bypasses write protection. Users are strongly encouraged to update to the latest version to mitigate this risk and ensure the integrity of their coding environment.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2026-25722 is a vulnerability in the @anthropic-ai/claude-code package that allows command injection, enabling attackers to bypass write protection in sensitive directories.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If you cannot update the package right away, avoid using the 'cd' command to navigate into sensitive directories as a temporary measure.
Exploitation of this vulnerability can lead to unauthorized file modifications, data loss, and compromise of sensitive information within the Claude Code environment.
The CVSS score for this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
