npm/@anthropic-ai/claude-code CVE-2025-66032: critical 9.8, EPSS 0.74%

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

Action: Upgrade @anthropic-ai/claude-code to 1.0.93 or later.

npm i @anthropic-ai/claude-code@1.0.93

Affected

Fixed versions

Sources

• osv: GHSA-xq4m-mc3c-vvg3
• nvd: CVE-2025-66032
• https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3
• https://github.com/anthropics/claude-code

CVE-2025-66032 · published 2025-12-03T16:27:19Z · modified 2025-12-05T12:27:53.035426Z · JSON