CVE-2026-25722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25722", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T16:48:00.425Z", "datePublished": "2026-02-06T17:52:42.069Z", "dateUpdated": "2026-02-06T18:42:01.040Z"}, "containers": {"cna": {"title": "Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh"}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"version": "< 2.0.57", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T17:52:42.069Z"}, "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57."}], "source": {"advisory": "GHSA-66q4-vfjg-2qhh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T18:41:50.485891Z", "id": "CVE-2026-25722", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T18:42:01.040Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T18:41:50.485891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T18:41:54.404Z"}}], "cna": {"title": "Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection", "source": {"advisory": "GHSA-66q4-vfjg-2qhh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"status": "affected", "version": "< 2.0.57"}]}], "references": [{"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh", "name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T17:52:42.069Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25722", "state": "PUBLISHED", "dateUpdated": "2026-02-06T18:42:01.040Z", "dateReserved": "2026-02-05T16:48:00.425Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T17:52:42.069Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "claude-code", "vendor": "anthropics", "versions": [{"status": "affected", "version": "< 2.0.57"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "30804A02-7373-4C9F-AE17-E2C3EA396DDF", "versionEndExcluding": "2.0.57", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57."}, {"lang": "es", "value": "Claude Code es una herramienta de codificaci\u00f3n ag\u00e9ntica. Antes de la versi\u00f3n 2.0.57, Claude Code no validaba correctamente los cambios de directorio cuando se combinaba con operaciones de escritura en carpetas protegidas. Al usar el comando cd para navegar a directorios sensibles como .claude, era posible eludir la protecci\u00f3n contra escritura y crear o modificar archivos sin confirmaci\u00f3n del usuario. La explotaci\u00f3n fiable de esto requer\u00eda la capacidad de a\u00f1adir contenido no confiable en una ventana de contexto de Claude Code. Este problema ha sido parcheado en la versi\u00f3n 2.0.57."}], "id": "CVE-2026-25722", "lastModified": "2026-06-17T10:25:06.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25722", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T18:41:50.485891Z", "version": "2.0.3"}}]}, "published": "2026-02-06T18:15:59.077", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:23:19.176699+00:00", "value": {"mitigation_remediation": ["Update Claude Code to version 2.0.57 or later to apply the patch that restores proper directory validation.", "If upgrading is not immediately possible, restrict write access to sensitive directories such as .claude by setting appropriate filesystem permissions so the Claude Code process cannot create or modify files there.", "Sanitize or strictly control any untrusted content that can be entered into a context window, ensuring that commands such as cd are not processed without validation."], "summary": {"action": "Patch Now", "impact": "Command Injection enabling bypass of write protection"}, "threat_synthesis": {"affected_systems": "Vendor: Anthropic; Product: Claude Code; All releases before version 2.0.57 are affected. The vulnerability was fixed in v2.0.57 and later releases are considered safe.", "description_and_impact": "Claude Code versions before 2.0.57 allow a change of directory without adequate validation when combined with write operations to protected folders. By inserting the cd command into the context window, a user who can supply untrusted content can navigate into sensitive directories such as .claude and then create or modify files without user confirmation. The flaw therefore permits unauthorized file manipulation, code injection and potentially persistent compromise, and is classified as improper input validation (CWE\u201120) and OS command injection (CWE\u201178).", "risk_and_exploitability": "The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1\u202f% points to a low likelihood of exploitation at present. The flaw requires that an attacker be able to inject untrusted content into the context window, limiting the attack surface to environments that allow such content. It is not currently listed in the CISA KEV catalog. Because the vulnerability permits modification of protected files, an exploit could lead to persistence if the altered files are executed. The overall risk balances significant impact with a low probability of exploitation, and the most effective mitigation is to patch."}}}}, "created": "2026-02-09T10:50:01.893231+00:00", "updated": "2026-04-18T18:30:07.284955+00:00", "vendors": ["anthropics", "anthropics$PRODUCT$claude_code"]}