What is the CVSS score of CVE-2025-15060?

CVE-2025-15060 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of AI / ML are affected by CVE-2025-15060?

CVE-2025-15060 is a critical remote code execution vulnerability in claude-hovercraft that allows unauthenticated attackers to execute arbitrary commands with service account privileges.

How to fix or mitigate CVE-2025-15060?

Within 24 hours: Inventory all systems running claude-hovercraft and isolate affected instances from production networks if possible; disable the executeClaudeCode method or entire service if operationally feasible. Within 7 days: Implement network segmentation to restrict access to claude-hovercraft services; deploy WAF rules to block suspicious command injection patterns targeting the vulnerable endpoint; establish 24/7 monitoring for exploitation attempts. Within 30 days: Evaluate alternative solutions or request emergency patch from vendor; conduct forensic analysis of logs for evidence of compromise; prepare incident response procedures for potential breach scenarios.

AI / ML CVE-2025-15060

EUVD-2025-208667 CRITICAL

OS Command Injection (CWE-78)

2026-03-13 zdi

Command Injection RCE AI / ML Claude Hovercraft

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2025-208667

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:43 nvd

CRITICAL 9.8

DescriptionCVE.org

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the executeClaudeCode method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27785.