Arbitrary Code Execution Vulnerability in Claude Code by Anthropic
CVE-2025-66032

8.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
3 December 2025

What is CVE-2025-66032?

Prior to version 1.0.93, Claude Code, an agentic coding tool developed by Anthropic, was susceptible to a significant vulnerability where errors in the parsing of shell commands, specifically related to the Internal Field Separator ($IFS) and short command line interface (CLI) flags, allowed attackers to bypass the read-only validation mechanism. This flaw enabled the execution of arbitrary code, provided that the attacker could introduce untrusted content into the Claude Code context window. Users are strongly encouraged to upgrade to version 1.0.93 or later to mitigate this risk.

Affected Version(s)

claude-code < 1.0.93

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.