What is CVE-2026-25723?

CVE-2026-25723 is a medium-severity vulnerability in Anthropic Claude Code, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-02-06.

How severe is CVE-2026-25723?

Medium severity. CVSS v3 base score is 6.5 out of 10.

RCE in Anthropic Claude Code

CVE-2026-25723

Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Exploiting this required the ability to execute commands through Claude Code with the "accept edits" feature enabled. This issue has been patched in version 2.0.55.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (18.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Anthropic Claude_code
Anthropics Claude-code — versions < 2.0.55

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-25723?: CVE-2026-25723 is a medium-severity vulnerability in Anthropic Claude Code, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-02-06.
How severe is CVE-2026-25723?: Medium severity. CVSS v3 base score is 6.5 out of 10.