PT-2025-48978 · Anthropic · Claude-Code

Published 2025-12-03 · Updated 2026-01-15 · CVE-2025-66032

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.93

Description Claude Code is an agentic coding tool. Prior to version 1.0.93, errors in parsing shell commands related to $IFS and short CLI flags allowed bypassing the read-only validation, potentially leading to arbitrary code execution. Successful exploitation requires the ability to inject untrusted content into a Claude Code context window.

Recommendations Update to version 1.0.93 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-66032

GHSA-XQ4M-MC3C-VVG3

Affected Products

Claude-Code

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66032.json · Exploit
• https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66032 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66032 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1qdgmdj/top_10_trending_cves_15012026 · Reddit Post
• https://twitter.com/CVEnew/status/1996284703733633507 · Twitter Post
• https://twitter.com/SecReportCVE/status/2006377336556368173 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1qbvv1k/top_10_trending_cves_13012026 · Reddit Post
• https://t.me/CVEtracker/38776 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1qckizk/top_10_trending_cves_14012026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1996380178226831817 · Twitter Post
• https://t.me/cveNotify/144910 · Telegram Post
• https://twitter.com/flatt_sec_en/status/2010715968188862629 · Twitter Post