Loading...
Skip to main content
GeekWala

CVE-2025-64755 — Vulnerability in @anthropic-ai/claude-code — CVE...

HIGH

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

Published November 20, 2025Updated November 21, 2025Source: osv

Summary

Due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Thank you to Adam Chester - SpecterOps for reporting this issue!

Advisory Timeline

  • First published November 20, 2025 (326 days ago).
  • Last revised November 21, 2025 — 1 day after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @anthropic-ai/claude-code to 2.0.31 or later
npm install @anthropic-ai/claude-code@2.0.31

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
@anthropic-ai/claude-code
npm
All versions2.0.31

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-78
    OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-64755?
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-64755?
CVE-2025-64755 affects @anthropic-ai/claude-code. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-64755 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-7mv8-j34q-vp7q

Related CVEs

  • CVE-2026-107375
    HIGH

    JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

  • CVE-2026-107384
    HIGH

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

  • CVE-2026-39861
    HIGH

    Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

  • CVE-2025-66032
    HIGH

    Claude Code Command Validation Bypass Allows Arbitrary Code Execution

  • CVE-2026-54316
    MEDIUM

    Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies