Case claude-code-cve-2025-54795Agent hijackUnited States
Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794)
Two Claude Code flaws let untrusted content in the context window bypass the confirmation prompt to run commands, and escape working-directory limits via prefix path matching. Fixed in versions 1.0.20 and 0.2.111.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 5, 2025
- Location
- United States
- Target
- Anthropic Claude Code CLI
- Severity
- High
- Triggered by
- External security researchers (credited in Anthropic advisories)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-54795, CVE-2025-54794
What happened
Two Claude Code flaws let untrusted content in the context window bypass the confirmation prompt to run commands, and escape working-directory limits via prefix path matching. Fixed in versions 1.0.20 and 0.2.111.
Impact: Potential arbitrary command execution and out-of-scope file access on developer machines running Claude Code against untrusted repositories; no exploitation reported
Who triggered it
Actor: External security researchers (credited in Anthropic advisories)
Attribution: Coordinated disclosure to Anthropic; CVEs published August 2025
Motive: Security research
How it happened
Attack vector: Prompt injection via untrusted repository content causing a command parsing error that skips the confirmation prompt; path validation used prefix matching so sibling directories were reachable
Root cause: Insufficient command parsing and non-canonical path comparison in the CLI's safety checks
Timeline
- Fixes shipped in Claude Code 0.2.111 (path) and 1.0.20 (command injection)
- CVE-2025-54794 and CVE-2025-54795 published
Response
Anthropic patched both issues and published GitHub security advisories
Current status: Patched
Sources (open in a new tab)
- IsItPatched CVE-2025-54795 isitpatched.com
- Phoenix Security phoenix.security
Cite this case
Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794). AI Threat Watch, case claude-code-cve-2025-54795, Aug 5, 2025. https://aithreat.io/cases/claude-code-cve-2025-54795/
Permanent link: https://aithreat.io/cases/claude-code-cve-2025-54795/