# @anthropic-ai/claude-code (npm) vulnerabilities 28 known vulnerabilities (22 high, 4 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.1.319 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 2.1.319 (Nov 6, 2026), the latest release - Weekly downloads: 12.1M - Dependents: 1 - Releases: 500+ since 0.2.86 (Apr 26, 2025) - Registry: https://www.npmjs.com/package/@anthropic-ai/claude-code - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-86063: 0.2.86 to 2.1.178 (2.1.179 is outside it) - CVE-2026-55607: 2.1.38 to 2.1.162 (2.1.163 is outside it) - CVE-2026-46406: 2.1.59 to 2.1.126 (2.1.128 is outside it) - CVE-2026-54316: 0.2.86 to 2.1.162 (2.1.163 is outside it) - CVE-2026-40068: 2.1.63 to 2.1.83 (2.1.84 is outside it) - CVE-2026-39861: 0.2.86 to 2.1.63 (2.1.64 is outside it) - CVE-2026-35603: 0.2.86 to 2.1.74 (2.1.75 is outside it) - CVE-2026-33068: 0.2.86 to 2.1.52 (2.1.53 is outside it) - CVE-2026-25725: 0.2.86 to 2.1.1 (2.1.2 is outside it) - CVE-2026-25724: 0.2.86 to 2.1.6 (2.1.7 is outside it) - CVE-2026-25723: 0.2.86 to 2.0.54 (2.0.55 is outside it) - CVE-2026-25722: 0.2.86 to 2.0.56 (2.0.57 is outside it) - CVE-2026-24887: 0.2.86 to 2.0.71 (2.0.72 is outside it) - CVE-2026-24053: 0.2.86 to 2.0.73 (2.0.74 is outside it) - CVE-2026-24052: 0.2.86 to 1.0.110 (1.0.111 is outside it) - CVE-2026-21852: 0.2.86 to 2.0.64 (2.0.65 is outside it) - CVE-2025-66032: 0.2.86 to 1.0.92 (1.0.93 is outside it) - CVE-2025-64755: 0.2.86 to 2.0.30 (2.0.31 is outside it) - CVE-2025-65099: 0.2.86 to 1.0.38 (1.0.39 is outside it) - CVE-2025-59829: 0.2.86 to 1.0.119 (1.0.120 is outside it) - CVE-2025-59536: 0.2.86 to 1.0.110 (1.0.111 is outside it) - CVE-2025-59828: 0.2.86 to 1.0.38 (1.0.39 is outside it) - CVE-2025-59041: 0.2.86 to 1.0.103 (1.0.105 is outside it) - CVE-2025-58764: 0.2.86 to 1.0.103 (1.0.105 is outside it) - CVE-2025-55284: 0.2.86 to 1.0.3 (1.0.4 is outside it) - CVE-2025-54794: 0.2.86 to 0.2.109 (0.2.113 is outside it) - CVE-2025-54795: 0.2.86 to 1.0.19 (1.0.20 is outside it) - CVE-2025-52882: 0.2.116 to 1.0.23 (1.0.24 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (28) ### [CVE-2026-86063](https://cve.now/CVE-2026-86063): Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning - Severity: High 7.5 - Published: Oct 13, 2026 - Affected: fixed in 2.1.179. - Fixed in 2.1.179 (released Jun 16, 2026, 119 days before disclosure). - The latest release, 2.1.319, is not affected. - 22% of @anthropic-ai/claude-code downloads last week were affected versions (3.6M). ### [CVE-2026-55607](https://cve.now/CVE-2026-55607): Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution - Severity: High 7.7 - Published: Jun 29, 2026 - Affected: from 2.1.38, fixed in 2.1.163. - Fixed in 2.1.163 (released Jun 4, 2026, 25 days before disclosure). - The latest release, 2.1.319, is not affected. - 7.2% of @anthropic-ai/claude-code downloads last week were affected versions (1.2M). ### [CVE-2026-46406](https://cve.now/CVE-2026-46406): Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write - Severity: Medium 4.4 - Published: Jun 29, 2026 - Affected: from 2.1.59, fixed in 2.1.128. - Fixed in 2.1.128 (released May 4, 2026, 56 days before disclosure). - The latest release, 2.1.319, is not affected. - 6.4% of @anthropic-ai/claude-code downloads last week were affected versions (1M). ### [CVE-2026-54316](https://cve.now/CVE-2026-54316): Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch - Severity: Medium 6.0 - Published: Jun 23, 2026 - Affected: from 0.2.54, fixed in 2.1.163. - Fixed in 2.1.163 (released Jun 4, 2026, 19 days before disclosure). - The latest release, 2.1.319, is not affected. - 22% of @anthropic-ai/claude-code downloads last week were affected versions (3.6M). ### [CVE-2026-40068](https://cve.now/CVE-2026-40068): Claude Code arbitrary code execution via git worktree commondir trust dialog bypass - Severity: High 7.7 - Published: May 5, 2026 - Affected: from 2.1.63, fixed in 2.1.84. - Fixed in 2.1.84 (released Mar 25, 2026, 41 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.9% of @anthropic-ai/claude-code downloads last week were affected versions (144.4K). ### [CVE-2026-39861](https://cve.now/CVE-2026-39861): Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace - Severity: High 7.7 - Published: Apr 21, 2026 - Affected: fixed in 2.1.64. - Fixed in 2.1.64 (released Mar 3, 2026, 49 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-35603](https://cve.now/CVE-2026-35603): Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows - Severity: Medium 5.4 - Published: Apr 17, 2026 - Affected: fixed in 2.1.75. - Fixed in 2.1.75 (released Mar 13, 2026, 35 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-33068](https://cve.now/CVE-2026-33068): Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File - Severity: High 7.7 - Published: Mar 20, 2026 - Affected: fixed in 2.1.53. - Fixed in 2.1.53 (released Feb 24, 2026, 24 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-25725](https://cve.now/CVE-2026-25725): Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json - Severity: High 7.7 - Published: Feb 6, 2026 - Affected: fixed in 2.1.2. - Fixed in 2.1.2 (released Jan 8, 2026, 29 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-25724](https://cve.now/CVE-2026-25724): Claude Code Has Permission Deny Bypass Through Symbolic Links - Severity: Low 2.3 - Published: Feb 6, 2026 - Affected: fixed in 2.1.7. - Fixed in 2.1.7 (released Jan 13, 2026, 24 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-25723](https://cve.now/CVE-2026-25723): Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions - Severity: High 7.7 - Published: Feb 6, 2026 - Affected: fixed in 2.0.55. - Fixed in 2.0.55 (released Nov 26, 2025, 72 days before disclosure). - The latest release, 2.1.319, is not affected. - 14% of @anthropic-ai/claude-code downloads last week were affected versions (2.3M). ### [CVE-2026-25722](https://cve.now/CVE-2026-25722): Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection - Severity: High 7.7 - Published: Feb 6, 2026 - Affected: fixed in 2.0.57. - Fixed in 2.0.57 (released Dec 3, 2025, 65 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-24887](https://cve.now/CVE-2026-24887): Claude Code has a Command Injection in find Command Bypasses User Approval Prompt - Severity: High 7.7 - Published: Feb 3, 2026 - Affected: fixed in 2.0.72. - Fixed in 2.0.72 (released Dec 17, 2025, 48 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-24053](https://cve.now/CVE-2026-24053): Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes - Severity: High 7.7 - Published: Feb 3, 2026 - Affected: fixed in 2.0.74. - Fixed in 2.0.74 (released Dec 19, 2025, 46 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2026-24052](https://cve.now/CVE-2026-24052): Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains - Severity: High 7.1 - Published: Feb 3, 2026 - Affected: fixed in 1.0.111. - Fixed in 1.0.111 (released Sep 10, 2025, 146 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.8% of @anthropic-ai/claude-code downloads last week were affected versions (127.9K). ### [CVE-2026-21852](https://cve.now/CVE-2026-21852): Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation - Severity: Medium 5.3 - Published: Jan 21, 2026 - Affected: fixed in 2.0.65. - Fixed in 2.0.65 (released Dec 11, 2025, 41 days before disclosure). - The latest release, 2.1.319, is not affected. - 15% of @anthropic-ai/claude-code downloads last week were affected versions (2.4M). ### [CVE-2025-66032](https://cve.now/CVE-2025-66032): Claude Code Command Validation Bypass Allows Arbitrary Code Execution - Severity: High 8.7 - Published: Dec 3, 2025 - Affected: fixed in 1.0.93. - Fixed in 1.0.93 (released Aug 26, 2025, 99 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.7% of @anthropic-ai/claude-code downloads last week were affected versions (117.5K). ### [CVE-2025-64755](https://cve.now/CVE-2025-64755): @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes - Severity: High 8.7 - Published: Nov 21, 2025 - Affected: fixed in 2.0.31. - Fixed in 2.0.31 (released Oct 31, 2025, 21 days before disclosure). - The latest release, 2.1.319, is not affected. - 13% of @anthropic-ai/claude-code downloads last week were affected versions (2.1M). ### [CVE-2025-65099](https://cve.now/CVE-2025-65099): Claude Code vulnerable to command execution prior to startup trust dialog - Severity: High 7.7 - Published: Nov 19, 2025 - Affected: fixed in 1.0.39. - Fixed in 1.0.39 (released Jul 1, 2025, 141 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.2% of @anthropic-ai/claude-code downloads last week were affected versions (31K). ### [CVE-2025-59829](https://cve.now/CVE-2025-59829): Claude Code: Permission deny bypass is possible through symlink - Severity: Low 2.3 - Published: Oct 3, 2025 - Affected: fixed in 1.0.120. - Fixed in 1.0.120 (released Sep 19, 2025, 14 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.9% of @anthropic-ai/claude-code downloads last week were affected versions (142K). ### [CVE-2025-59536](https://cve.now/CVE-2025-59536): Claude Code's startup trust dialog could lead to Command Execution attack - Severity: High 8.7 - Published: Oct 3, 2025 - Affected: fixed in 1.0.111. - Fixed in 1.0.111 (released Sep 10, 2025, 23 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.8% of @anthropic-ai/claude-code downloads last week were affected versions (127.9K). ### [CVE-2025-59828](https://cve.now/CVE-2025-59828): Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions - Severity: High 7.7 - Published: Sep 24, 2025 - Affected: fixed in 1.0.39. - Fixed in 1.0.39 (released Jul 1, 2025, 85 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.2% of @anthropic-ai/claude-code downloads last week were affected versions (31K). ### [CVE-2025-59041](https://cve.now/CVE-2025-59041): Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email - Severity: High 8.7 - Published: Sep 10, 2025 - Affected: fixed in 1.0.105. - Fixed in 1.0.105 (released Sep 4, 2025, 6 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.8% of @anthropic-ai/claude-code downloads last week were affected versions (122.3K). ### [CVE-2025-58764](https://cve.now/CVE-2025-58764): Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution - Severity: High 8.7 - Published: Sep 10, 2025 - Affected: fixed in 1.0.105. - Fixed in 1.0.105 (released Sep 4, 2025, 6 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.8% of @anthropic-ai/claude-code downloads last week were affected versions (122.3K). ### [CVE-2025-55284](https://cve.now/CVE-2025-55284): Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code - Severity: High 7.1 - Published: Aug 16, 2025 - Affected: fixed in 1.0.4. - Fixed in 1.0.4 (released May 28, 2025, 80 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.1% of @anthropic-ai/claude-code downloads last week were affected versions (20K). ### [CVE-2025-54794](https://cve.now/CVE-2025-54794): Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access - Severity: High 7.7 - Published: Aug 5, 2025 - Affected: fixed in 0.2.111. - Fixed in 0.2.113 (released May 13, 2025, 84 days before disclosure, the advisory names 0.2.111, which was never published). - The latest release, 2.1.319, is not affected. - <0.1% of @anthropic-ai/claude-code downloads last week were affected versions (15.6K). ### [CVE-2025-54795](https://cve.now/CVE-2025-54795): Claude Code echo command allowed bypass of user approval prompt for command execution - Severity: High 8.7 - Published: Aug 5, 2025 - Affected: fixed in 1.0.20. - Fixed in 1.0.20 (released Jun 11, 2025, 55 days before disclosure). - The latest release, 2.1.319, is not affected. - 0.1% of @anthropic-ai/claude-code downloads last week were affected versions (23.6K). ### [CVE-2025-52882](https://cve.now/CVE-2025-52882): Claude Code IDE extensions allow websocket connections from arbitrary origins - Severity: High 8.8 - Published: Jun 24, 2025 - Affected: from 0.2.116, fixed in 1.0.24. - Fixed in 1.0.24 (released Jun 14, 2025, 10 days before disclosure). - The latest release, 2.1.319, is not affected. - <0.1% of @anthropic-ai/claude-code downloads last week were affected versions (8.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@anthropic-ai/claude-code Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.