CVE Feed

    Dashboard / CVE / CVE-2025-55284

    CVE-2025-55284

    Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update.

    Published:Aug 16, 2025
    Last Modified:Oct 24, 2025
    EPS:Aug 16, 2025
    EPSS Score:0.0007
    CVSS Score:7.5

    Affected Products

    Vendor
    Anthropic
    Product
    Claude Code
    Vendor
    Anthropics
    Product
    Claude Code

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-40068 (CVSS 7.7) — In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree c…
    CVE-2026-39861 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxe…
    CVE-2026-35603 (CVSS 5.4) — Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-w…
    CVE-2026-35022 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavio…
    CVE-2026-35021 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the affected code p…
    CVE-2026-35020 — This CVE ID has been rejected by the its CVE Numbering Authority (CNA). It was determined that the attack requ…
    CVE-2026-33068 (CVSS 7.7) — Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings fil…
    CVE-2026-25725 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism f…
    CVE-2026-25724 (CVSS 2.3) — Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rul…
    CVE-2026-25723 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate comman…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High