Browse CVEs

HIGH 8.8 CVE-2026-55607 Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and nav… Claude Code 2.1.163+ Fix from $1,9502026-06-29 MEDIUM 6.1 CVE-2026-46406 Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/t… Claude Code 2.1.128+ Fix from $1,6002026-06-29 CRITICAL 9.1 CVE-2026-54316 Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the We… Claude Code 2.1.163+ Fix from $2,3002026-06-23 HIGH 7.8 CVE-2026-44470 The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the Cowo… Claude Desktop 1.3834.0+ Fix from $1,9502026-05-13 MEDIUM 6.8 CVE-2026-44467 The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4… Claude Desktop 1.4304.0+ Fix from $1,6002026-05-13 HIGH 8.8 CVE-2026-40068 In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its co… Claude Code 2.1.84+ Fix from $1,9502026-05-05 CRITICAL 10.0 CVE-2026-39861 Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks poin… Claude Code 2.1.64+ Fix from $2,3002026-04-21 HIGH 7.3 CVE-2026-35603 Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\Progr… Claude Code 2.1.75+ Fix from $1,9502026-04-17 MEDIUM 5.4 CVE-2026-34451 Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before ver… Claude Sdk For Typescript 0.81.0+ Fix from $1,6002026-03-31 MEDIUM 5.3 CVE-2026-34452 The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local f… Claude Sdk For Python 0.87.0+ Fix from $1,6002026-03-31 HIGH 7.8 CVE-2026-22561 Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escal… Claude 1.1.3363+ Fix from $1,9502026-03-31 HIGH 8.8 CVE-2026-33068 Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .clau… Claude Code 2.1.53+ Fix from $1,9502026-03-20 CRITICAL 10.0 CVE-2026-25725 Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/s… Claude Code 2.1.2+ Fix from $2,3002026-02-06 HIGH 7.5 CVE-2026-25724 Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when acc… Claude Code 2.1.7+ Fix from $1,9502026-02-06 CRITICAL 9.1 CVE-2026-25722 Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write op… Claude Code 2.0.57+ Fix from $2,3002026-02-06 MEDIUM 6.5 CVE-2026-25723 Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the … Claude Code 2.0.55+ Fix from $1,6002026-02-06 HIGH 8.8 CVE-2026-24887 Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirm… Claude Code 2.0.72+ Fix from $1,9502026-02-03 HIGH 7.4 CVE-2026-24052 Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification… Claude Code 1.0.111+ Fix from $1,9502026-02-03 MEDIUM 6.5 CVE-2026-24053 Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible … Claude Code 2.0.74+ Fix from $1,6002026-02-03 HIGH 7.5 CVE-2026-21852EPSS 23% Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to ex… Claude Code 2.0.65+ Fix from $1,9502026-01-21 CRITICAL 9.8 CVE-2025-66032 Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible … Claude Code 1.0.93+ Fix from $2,3002025-12-03 CRITICAL 9.8 CVE-2025-64755 Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code rea… Claude Code 2.0.31+ Fix from $2,3002025-11-21 CRITICAL 9.8 CVE-2025-65099 Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked… Claude Code 1.0.39+ Fix from $2,3002025-11-19 MEDIUM 6.5 CVE-2025-59829 Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitl… Claude Code 1.0.120+ Fix from $1,6002025-10-03 HIGH 8.8 CVE-2025-59536EPSS 33% Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementat… Claude Code 1.0.111+ Fix from $1,9502025-10-03 CRITICAL 9.8 CVE-2025-59828 Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-exe… Claude Code 1.0.39+ Fix from $2,3002025-09-24 CRITICAL 9.8 CVE-2025-59041 Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105… Claude Code 1.0.105+ Fix from $2,3002025-09-10 CRITICAL 9.8 CVE-2025-58764 Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code c… Claude Code 1.0.105+ Fix from $2,3002025-09-10 HIGH 7.5 CVE-2025-55284 Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then s… Claude Code 1.0.4+ Fix from $1,9502025-08-16 CRITICAL 9.8 CVE-2025-54795 Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation… Claude Code 1.0.20+ Fix from $2,3002025-08-05