GitHub Advisoryadvisory · npm

GHSA-66q4-vfjg-2qhh Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

HIGH Published 2026-02-06 Modified 2026-02-06 Official page ↗
Aliases
CVE-2026-25722
Ecosystem
npm
Packages
@anthropic-ai/claude-code
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-78
Reviewed
2026-02-06

Affected packages

• npm @anthropic-ai/claude-code: < 2.0.57 → fixed in 2.0.57

Description

Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the `cd` command to navigate into sensitive directories like `.claude`, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically. Users performing manual updates are advised to update to the latest version. About Claude Code thanks hackerone.com/nil221 for reporting this issue!

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References