Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Exploiting this required the ability to execute commands through Claude Code with the "accept edits" feature enabled. This issue has been patched in version 2.0.55.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25723 Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, all… https://www.cve.org/CVERecord?id=CVE-2026-25723
Post summary
The post references CVE‑2026‑25723, noting that prior to version 2.0.55 Claude Code mishandles piped sed operations with echo, and that the issue is addressed in later releases.
CVE-2026-25723: Claude Code & The Echo Chamber: CVE-2026-25723 In the race to build autonomous coding agents, Anthropic's 'Claude Code' (claude-code) stumbled over a classic Unix pitfall. CVE-2026-25723 is a high-severity file write restriction bypass... https://cvereports.com/reports/CVE-2026-25723
Post summary
The excerpt announces CVE‑2026‑25723 as a high‑severity file‑write restriction bypass in Anthropic’s Claude Code, providing basic technical details but no PoC, exploitation evidence, or patch information.
BREAKING: Four flaws in Anthropic Claude Code (CVE-2026-33068, CVE-2026-25723, CVE-2026-21852, CVE-2025-59536) enable trust bypass, arbitrary file writes and API key exfiltration in unpatched versions. https://threatcluster.io/cluster/multiple-vulnerabilities-in-claude-code-expose-users-to-secu-9e448964
Post summary
The post announces four new CVEs in Anthropic Claude Code that enable trust bypass, arbitrary file writes, and API key exfiltration in unpatched versions.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | anthropic | claude_code | - | node.js | - |