Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@anthropic-ai/claude-code

28 known vulnerabilities (22 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
2.1.319 (Nov 6, 2026): no advisory affects it
Newest unaffected release
2.1.319 (Nov 6, 2026), the latest release
Advisories
28 · 22 high, 4 medium, 2 low
Weekly downloads
12.1M
Dependents
1
Releases
500+ since 0.2.86 (Apr 26, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 28 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 28

  • Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

    Affected: fixed in 2.1.179.

    Fixed in 2.1.179 (released Jun 16, 2026, 119 days before disclosure).

    The latest release, 2.1.319, is not affected.

    22% of @anthropic-ai/claude-code downloads last week were affected versions (3.6M).

  • Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

    Affected: from 2.1.38, fixed in 2.1.163.

    Fixed in 2.1.163 (released Jun 4, 2026, 25 days before disclosure).

    The latest release, 2.1.319, is not affected.

    7.2% of @anthropic-ai/claude-code downloads last week were affected versions (1.2M).

  • CVE-2026-46406Medium 4.4

    Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write

    Affected: from 2.1.59, fixed in 2.1.128.

    Fixed in 2.1.128 (released May 4, 2026, 56 days before disclosure).

    The latest release, 2.1.319, is not affected.

    6.4% of @anthropic-ai/claude-code downloads last week were affected versions (1M).

  • CVE-2026-54316Medium 6.0

    Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

    Affected: from 0.2.54, fixed in 2.1.163.

    Fixed in 2.1.163 (released Jun 4, 2026, 19 days before disclosure).

    The latest release, 2.1.319, is not affected.

    22% of @anthropic-ai/claude-code downloads last week were affected versions (3.6M).

  • Claude Code arbitrary code execution via git worktree commondir trust dialog bypass

    Affected: from 2.1.63, fixed in 2.1.84.

    Fixed in 2.1.84 (released Mar 25, 2026, 41 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.9% of @anthropic-ai/claude-code downloads last week were affected versions (144.4K).

  • Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

    Affected: fixed in 2.1.64.

    Fixed in 2.1.64 (released Mar 3, 2026, 49 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • CVE-2026-35603Medium 5.4

    Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

    Affected: fixed in 2.1.75.

    Fixed in 2.1.75 (released Mar 13, 2026, 35 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

    Affected: fixed in 2.1.53.

    Fixed in 2.1.53 (released Feb 24, 2026, 24 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json

    Affected: fixed in 2.1.2.

    Fixed in 2.1.2 (released Jan 8, 2026, 29 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code Has Permission Deny Bypass Through Symbolic Links

    Affected: fixed in 2.1.7.

    Fixed in 2.1.7 (released Jan 13, 2026, 24 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

    Affected: fixed in 2.0.55.

    Fixed in 2.0.55 (released Nov 26, 2025, 72 days before disclosure).

    The latest release, 2.1.319, is not affected.

    14% of @anthropic-ai/claude-code downloads last week were affected versions (2.3M).

  • Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

    Affected: fixed in 2.0.57.

    Fixed in 2.0.57 (released Dec 3, 2025, 65 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

    Affected: fixed in 2.0.72.

    Fixed in 2.0.72 (released Dec 17, 2025, 48 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

    Affected: fixed in 2.0.74.

    Fixed in 2.0.74 (released Dec 19, 2025, 46 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

    Affected: fixed in 1.0.111.

    Fixed in 1.0.111 (released Sep 10, 2025, 146 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.8% of @anthropic-ai/claude-code downloads last week were affected versions (127.9K).

Show all 28 advisoriesShow fewer advisories
  • CVE-2026-21852Medium 5.3

    Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

    Affected: fixed in 2.0.65.

    Fixed in 2.0.65 (released Dec 11, 2025, 41 days before disclosure).

    The latest release, 2.1.319, is not affected.

    15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M).

  • Claude Code Command Validation Bypass Allows Arbitrary Code Execution

    Affected: fixed in 1.0.93.

    Fixed in 1.0.93 (released Aug 26, 2025, 99 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.7% of @anthropic-ai/claude-code downloads last week were affected versions (117.5K).

  • @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

    Affected: fixed in 2.0.31.

    Fixed in 2.0.31 (released Oct 31, 2025, 21 days before disclosure).

    The latest release, 2.1.319, is not affected.

    13% of @anthropic-ai/claude-code downloads last week were affected versions (2.1M).

  • Claude Code vulnerable to command execution prior to startup trust dialog

    Affected: fixed in 1.0.39.

    Fixed in 1.0.39 (released Jul 1, 2025, 141 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.2% of @anthropic-ai/claude-code downloads last week were affected versions (31K).

  • Claude Code: Permission deny bypass is possible through symlink

    Affected: fixed in 1.0.120.

    Fixed in 1.0.120 (released Sep 19, 2025, 14 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.9% of @anthropic-ai/claude-code downloads last week were affected versions (142K).

  • Claude Code's startup trust dialog could lead to Command Execution attack

    Affected: fixed in 1.0.111.

    Fixed in 1.0.111 (released Sep 10, 2025, 23 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.8% of @anthropic-ai/claude-code downloads last week were affected versions (127.9K).

  • Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

    Affected: fixed in 1.0.39.

    Fixed in 1.0.39 (released Jul 1, 2025, 85 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.2% of @anthropic-ai/claude-code downloads last week were affected versions (31K).

  • Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

    Affected: fixed in 1.0.105.

    Fixed in 1.0.105 (released Sep 4, 2025, 6 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.8% of @anthropic-ai/claude-code downloads last week were affected versions (122.3K).

  • Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution

    Affected: fixed in 1.0.105.

    Fixed in 1.0.105 (released Sep 4, 2025, 6 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.8% of @anthropic-ai/claude-code downloads last week were affected versions (122.3K).

  • Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code

    Affected: fixed in 1.0.4.

    Fixed in 1.0.4 (released May 28, 2025, 80 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.1% of @anthropic-ai/claude-code downloads last week were affected versions (20K).

  • Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

    Affected: fixed in 0.2.111.

    Fixed in 0.2.113 (released May 13, 2025, 84 days before disclosure, the advisory names 0.2.111, which was never published).

    The latest release, 2.1.319, is not affected.

    <0.1% of @anthropic-ai/claude-code downloads last week were affected versions (15.6K).

  • Claude Code echo command allowed bypass of user approval prompt for command execution

    Affected: fixed in 1.0.20.

    Fixed in 1.0.20 (released Jun 11, 2025, 55 days before disclosure).

    The latest release, 2.1.319, is not affected.

    0.1% of @anthropic-ai/claude-code downloads last week were affected versions (23.6K).

  • Claude Code IDE extensions allow websocket connections from arbitrary origins

    Affected: from 0.2.116, fixed in 1.0.24.

    Fixed in 1.0.24 (released Jun 14, 2025, 10 days before disclosure).

    The latest release, 2.1.319, is not affected.

    <0.1% of @anthropic-ai/claude-code downloads last week were affected versions (8.7K).