RCE in Anthropics Claude-code

CVE-2026-25722

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive director…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (40.4th percentile) — read the EPSS interpretation.

Affected products

Anthropics Claude-code — versions < 2.0.57

Weakness classification (CWE)

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh (x_refsource_CONFIRM)