CVE-2026-25723: @anthropic-ai/claude-code Command Injection Vulnerability
Summary
CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions. Affects @anthropic-ai/claude-code versions < 2.0.55. Fixed in 2.0.55. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is an innovative tool developed by Anthropic AI that allows users to write and execute code efficiently. It features an 'accept edits' functionality that enables collaborative coding. However, this feature has a significant vulnerability that can be exploited to bypass file write restrictions, potentially compromising sensitive directories.
Vulnerability Detail
The vulnerability arises from Claude Code's inadequate validation of commands that utilize piped sed operations with the echo command. This flaw allows attackers to execute arbitrary commands, leading to unauthorized writing in sensitive directories such as the .claude folder and paths outside the intended project scope. The exploitation of this vulnerability requires the 'accept edits' feature to be enabled, which could lead to severe security breaches, including data loss or unauthorized access to sensitive information.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.55
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.0.55Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'accept edits' feature in Claude Code to mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2026-25723 vulnerability in the @anthropic-ai/claude-code package poses a significant risk due to command injection capabilities that can bypass file write restrictions. Users are urged to update to the patched version 2.0.55 to secure their applications and mitigate potential threats.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2026-25723 is a command injection vulnerability in the @anthropic-ai/claude-code package that allows attackers to bypass file write restrictions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities using your package-lock.json.
Exploitation of this vulnerability could lead to unauthorized access to sensitive directories, data loss, or other security breaches.
Yes, a patch is available in version 2.0.55 of the @anthropic-ai/claude-code package. Users should update to this version.
If you cannot update the package, it is recommended to disable the 'accept edits' feature as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
