npm/@anthropic-ai/claude-code CVE-2026-25722: critical 9.1, EPSS 0.52%

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

Action: Upgrade @anthropic-ai/claude-code to 2.0.57 or later.

npm i @anthropic-ai/claude-code@2.0.57

Affected

Fixed versions

Sources

• osv: GHSA-66q4-vfjg-2qhh
• nvd: CVE-2026-25722
• https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh
• https://github.com/anthropics/claude-code

CVE-2026-25722 · published 2026-02-06T19:02:41Z · modified 2026-02-06T19:56:44.198671Z · JSON