Command Parsing Vulnerability in Claude Code by Anthropic
CVE-2025-58764

8.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
10 September 2025

What is CVE-2025-58764?

Claude Code, an agentic coding tool developed by Anthropic, is susceptible to a command parsing vulnerability due to an oversight in the handling of command prompts. This flaw allows for the potential bypass of the confirmation prompt, leading to the execution of untrusted commands. Successful exploitation necessitates that an attacker can inject unauthorized content into a Claude Code context window. Users on the standard auto-update mechanism have already received the necessary fix. Those who manually update are encouraged to upgrade to version 1.0.105 or later to mitigate this risk.

Affected Version(s)

claude-code < 1.0.105

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58764 : Command Parsing Vulnerability in Claude Code by Anthropic