CVE-2026-25723: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope.
What it is
Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Exploiting this required the ability to execute commands through Claude Code with the "accept edits" feature enabled.
Users on standard Claude Code auto-update received this fix automatically. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/nil221 for reporting this issue!
How to check
- Affected: @anthropic-ai/claude-code (npm) < 2.0.55.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @anthropic-ai/claude-code to 2.0.55 or later.
npm ls @anthropic-ai/claude-code -g # or: claude --versionSources
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalUpGuard: 16,326 Supabase databases had readable tables
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-103435: Claude Code could be raced into writing files outside the project