What is the CVSS score of CVE-2026-25722?

CVE-2026-25722 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of AI / ML are affected by CVE-2026-25722?

Claude Code versions prior to 2.0.57 contain a critical vulnerability allowing unauthorized write operations to protected system folders through improper directory validation.. A patch is available.

How to fix or mitigate CVE-2026-25722?

Within 24 hours: Inventory all Claude Code deployments and document current versions in use; disable Claude Code in production environments where feasible. Within 7 days: Implement network segmentation to restrict Claude Code instances from accessing sensitive folders and implement enhanced logging/monitoring of file system activities. Within 30 days: Establish vendor communication plan for patch availability and prepare deployment procedures; conduct security assessment of any systems where Claude Code operated with elevated privileges.

AI / ML CVE-2026-25722

CRITICAL

Improper Input Validation (CWE-20)

2026-02-06 security-advisories@github.com

GHSA-66q4-vfjg-2qhh

Code Injection AI / ML Claude Code

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 18:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.

AnalysisAI

Claude Code prior to version 2.0.57 failed to properly validate MCP tool inputs, allowing malicious MCP servers to inject commands through tool responses.

Technical ContextAI

Claude Code < 2.0.57 has a CWE-20 improper input validation vulnerability where MCP tool inputs were not properly validated, allowing malicious MCP servers to inject commands through crafted tool responses.