npm/@anthropic-ai/claude-code CVE-2025-54794: critical 9.1, EPSS 1.45%

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Action: Upgrade @anthropic-ai/claude-code to 0.2.111 or later.

npm i @anthropic-ai/claude-code@0.2.111

Affected

Fixed versions

Sources

• osv: GHSA-pmw4-pwvc-3hx2
• nvd: CVE-2025-54794
• https://github.com/anthropics/claude-code/security/advisories/GHSA-pmw4-pwvc-3hx2
• https://github.com/anthropics/claude-code

CVE-2025-54794 · published 2025-08-04T15:15:52Z · modified 2025-08-05T17:10:27Z · JSON