How severe is CVE-2026-25722?

CVE-2026-25722 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.

Is CVE-2026-25722 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25722?

CVE-2026-25722 affects Anthropic Claude Code. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25722?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-25722 have an EU (EUVD) identifier?

Yes. CVE-2026-25722 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5636.

When was CVE-2026-25722 published?

CVE-2026-25722 was published on 2026-02-06 and last updated on 2026-06-17.

CVE-2026-25722

CVE-2026-25722 is a critical-severity vulnerability in Anthropic Claude Code with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v4: 7.7
EPSS exploit prediction: 0% (28th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-5636
Weakness: CWE-20
Affected product: Anthropic Claude Code
Published: 2026-02-06
Last modified: 2026-06-17

Description

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.

Frequently asked questions

What is CVE-2026-25722?: Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.
How severe is CVE-2026-25722?: CVE-2026-25722 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2026-25722 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25722?: CVE-2026-25722 affects Anthropic Claude Code. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25722?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-25722 have an EU (EUVD) identifier?: Yes. CVE-2026-25722 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5636.
When was CVE-2026-25722 published?: CVE-2026-25722 was published on 2026-02-06 and last updated on 2026-06-17.

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh

Affected products (1)

cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

More vulnerabilities in Anthropic Claude Code

CVE-2026-39861 — Critical (CVSS 10.0): Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed…
CVE-2026-25725 — Critical (CVSS 10.0): Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to…
CVE-2025-66032 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and…
CVE-2025-64755 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible…
CVE-2025-65099 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above,…
CVE-2025-59828 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions…

All CVEs affecting Anthropic Claude Code →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →