RCE in Anthropics Claude-code

CVE-2025-66032

Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Relia…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.000 (12.1th percentile) — read the EPSS interpretation.

Affected products

Anthropics Claude-code — versions < 1.0.93

Weakness classification (CWE)

CWE-77 — Command Injection

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3 (x_refsource_CONFIRM)