CVE-2025-58764: Command Bypass in @anthropic-ai/claude-code

Successful exploitation of CVE-2025-58764 allows an attacker to execute arbitrary commands within the context of the @anthropic-ai/claude-code application. This could involve reading sensitive data, modifying system configurations, or even gaining control of the underlying server. The ability to reliably exploit this vulnerability requires the attacker to inject untrusted content into a Claude Code context window, suggesting a potential attack vector through user-supplied input or compromised data sources. The blast radius depends on the privileges associated with the process running @anthropic-ai/claude-code.

1. Reserved2025-09-04
2. Published2025-09-10
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58764 is to immediately update to version 1.0.105 or later of the @anthropic-ai/claude-code package. Users employing manual update procedures should prioritize this update. If an immediate upgrade is not feasible, consider implementing input validation and sanitization measures to prevent the injection of untrusted content into the Claude Code context window. While a direct WAF rule is unlikely, monitoring for unusual command execution patterns within the Node.js application could provide an early warning system. After upgrading, verify the fix by attempting to trigger the command bypass with known malicious input and confirming that the confirmation prompt is enforced.