CVE Feed

    Dashboard / CVE / CVE-2025-54795

    CVE-2025-54795

    Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This is fixed in version 1.0.20.

    Published:Aug 5, 2025
    Last Modified:Oct 24, 2025
    EPS:Aug 5, 2025
    EPSS Score:0.00174
    CVSS Score:9.8

    Affected Products

    Vendor
    Anthropic
    Product
    Claude Code
    Vendor
    Anthropics
    Product
    Claude Code

    Exploits

    https://github.com/alonisser/ralph

    Related CVEs

    CVE-2026-40068 (CVSS 7.7) — In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree c…
    CVE-2026-39861 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxe…
    CVE-2026-35603 (CVSS 5.4) — Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-w…
    CVE-2026-35022 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavio…
    CVE-2026-35021 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the affected code p…
    CVE-2026-35020 — This CVE ID has been rejected by the its CVE Numbering Authority (CNA). It was determined that the attack requ…
    CVE-2026-33068 (CVSS 7.7) — Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings fil…
    CVE-2026-25725 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism f…
    CVE-2026-25724 (CVSS 2.3) — Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rul…
    CVE-2026-25723 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate comman…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High