Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts

Vulnerability · Claude Code · HIGH

Incident dateNot stated

DisclosedAug 1 to Oct 3, 2025 (four advisories)

Added hereOct 14, 12:16 AM ET

Last verifiedOct 14, 2026

Summary

Anthropic published a series of advisories in 2025 for Claude Code. In each, content an attacker could get into the context window (a file, a web page) could lead to commands running without the user's approval, or to file contents being sent over the network. All were fixed, and auto-update delivered the fixes.

Severity

HIGH Code execution or data exfiltration from a developer machine. Each required untrusted content in context or starting in an untrusted folder. All patched.

Timeline

Aug 16, 2025 (NVD)
CVE-2025-55284: overly broad 'safe command' allowlist let files be read and sent out without confirmation. Fixed in 1.0.4.
Aug 1, 2025 (GitHub advisory)
CVE-2025-54795: command-parsing error (echo) bypassed the confirmation prompt. Fixed in 1.0.20.
Sep 10, 2025 (NVD)
CVE-2025-58764: another command-parsing bypass. Fixed in 1.0.105.
Oct 3, 2025
CVE-2025-59536: code in a project could run before the startup trust dialog was accepted. Fixed in 1.0.111.

How it happened

Coding agents decide which shell commands are 'safe' to run without asking. Parsing mistakes and allowlists that were too broad meant a crafted command could pass as safe. Anthropic's advisories note that versions before 1.0.24 were deprecated and force-updated.

How to check your app

Run claude --version and make sure you are on a current release.
Keep the approval prompts on when the agent reads code, issues or web pages you did not write.
Don't start an agent in a freshly cloned, untrusted repo before you have looked at its config files.

Sources

Corrections and updates

Oct 14, 2026
Added publication dates for each CVE and said which record each date comes from.

If you want a quick way to check the basics above on your own app, LockedVibe publishes a free Lockdown Pack with the prompts and checks for RLS, auth and exposed keys.