IDEs & agents · Anthropic
Claude Code
Anthropic’s terminal coding agent.
25Advisories
0critical
25high
0medium
2026-10-15Latest
Timeline · advisories per quarter
12025 Q1
32025 Q2
62025 Q3
42025 Q4
72026 Q1
22026 Q2
12026 Q3
12026 Q4
Named in sources
Reported for Claude Code
01. CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningThe plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. Claude Code 2026-10-15 02. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 03. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 04. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 05. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 06. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 07. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 08. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 09. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 10. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 11. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 12. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 13. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 14. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 15. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 16. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 17. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 18. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 19. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 20. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 21. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 22. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 23. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code 
Copilot 
Cursor +5 more 2025
Claude Code 2026-10-15 02. CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionClaude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Claude Code 2026-07-24 03. CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionClaude Code used the git worktree commondir file when determining folder trust but did not validate its contents. Claude Code 2026-04-24 04. CVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceClaude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. Claude Code 2026-04-21 05. CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileClaude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. Claude Code 2026-03-19 06. CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.jsonClaude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. Claude Code 2026-02-06 07. CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write RestrictionsClaude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Claude Code 2026-02-06 08. CVE-2026-25722: Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write ProtectionClaude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Claude Code 2026-02-06 09. CVE-2026-24887: Claude Code has a Command Injection in find Command Bypasses User Approval PromptDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Claude Code 2026-02-03 10. CVE-2026-24053: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesDue to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Claude Code 2026-02-03 11. CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsClaude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. Claude Code 2026-02-03 12. CVE-2025-66032: Claude Code Command Validation Bypass Allows Arbitrary Code ExecutionDue to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-12-03 13. CVE-2025-64755: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File WritesDue to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Claude Code 2025-11-20 14. CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialogWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-11-19 15. CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialogDue to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Claude Code 2025-10-03 16. CVE-2025-59828: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsWhen using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. Claude Code 2025-09-24 17. CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailAt startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. Claude Code 2025-09-10 18. CVE-2025-58764: Claude Code rg vulnerability does not protect against approval prompt bypassDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-09-10 19. CVE-2025-55284: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeDue to an overly broad allowlist of safe commands, it was possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation. Claude Code 2025-08-18 20. CVE-2025-54795: Claude Code echo command allowed bypass of user approval prompt for command executionDue to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Claude Code 2025-08-04 21. CVE-2025-54794: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessDue to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Claude Code 2025-08-04 22. CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary originsClaude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when visiting attacker-controlled webpages. Claude Code 2025-06-23 23. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 Same pattern
Also worth checking
01. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. 
MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 02. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01
MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 02. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01