What is the CVSS score of CVE-2026-25722?

CVE-2026-25722 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-25722?

Within 24 hours: Inventory all Claude Code deployments and document current versions in use; disable Claude Code in production environments where feasible. Within 7 days: Implement network segmentation to restrict Claude Code instances from accessing sensitive folders and implement enhanced logging/monitoring of file system activities. Within 30 days: Establish vendor communication plan for patch availability and prepare deployment procedures; conduct security assessment of any systems where Claude Code operated with elevated privileges.

Claude Code CVE-2026-25722

Q: Which versions of Claude Code are affected by CVE-2026-25722?

Claude Code versions prior to 2.0.57 contain a critical vulnerability allowing unauthorized write operations to protected system folders through improper directory validation.. A patch is available.

CRITICAL

Improper Input Validation (CWE-20)

2026-02-06 security-advisories@github.com

GHSA-66q4-vfjg-2qhh

Code Injection AI / ML Claude Code Anthropic

9.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Inject untrusted content into Claude Code context
Exploit

Execute cd command to navigate to .claude directory
Execution

Bypass write protection validation
Impact

Modify or create protected files without confirmation

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Claude Code version prior to 2.0.57 with untrusted user-supplied content in context window. Requires ability to provide input to Claude Code that triggers command execution, such as through chat interface or API accepting user prompts.
Impact	CVSS 9.1 — Claude Code runs on developer workstations with access to source code and credentials. MCP server compromise could cascade to full development environment takeover.
Exploit ScenarioDerived	A developer connects Claude Code to a malicious MCP server that returns crafted tool responses containing injected commands, which execute on the developer's workstation.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Claude Code prior to version 2.0.57 failed to properly validate MCP tool inputs, allowing malicious MCP servers to inject commands through tool responses.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.1

Input validation failure in Claude Code enables command injection via malicious MCP servers.

RemediationAI

Update Claude Code to 2.0.57+. Only connect to trusted MCP servers.

Affected Packages

npm @anthropic-ai/claude-code fix: 2.0.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Claude Code < 2.0.57 has a CWE-20 improper input validation vulnerability where MCP tool inputs were not properly validated, allowing malicious MCP servers to inject commands through crafted tool responses.

Know when Claude Code gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Feb 06, 2026 - 18:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.

Executive ViewAI

Why It Matters

Claude Code versions prior to 2.0.57 contain a critical vulnerability allowing unauthorized write operations to protected system folders through improper directory validation. Organizations using Claude Code for development or automation face risk of system compromise, data exfiltration, and operational disruption until patching is available.

Business Impact: Severe

Compensating Controls

Disable Claude Code write permissions to protected directories via OS-level access controls; implement host-based file integrity monitoring (HIDS) to alert on unauthorized writes to critical folders; restrict Claude Code process privileges using least-privilege principles; isolate Claude Code instances in containerized environments with limited filesystem access; monitor and log all Claude Code file operations; consider disabling agentic features until patch is released.

Threat Intelligence Overview

EPSS Score

0.2%

Top 63% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.