What is CVE-2026-25722?

CVE-2026-25722 is a critical-severity vulnerability in Anthropic Claude_code, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2026-02-06.

How severe is CVE-2026-25722?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in Anthropic Claude_code

CVE-2026-25722

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive director…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (28.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Anthropic Claude_code
Anthropics Claude-code — versions < 2.0.57

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-25722?: CVE-2026-25722 is a critical-severity vulnerability in Anthropic Claude_code, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2026-02-06.
How severe is CVE-2026-25722?: Critical severity. CVSS v3 base score is 9.1 out of 10.