CVE-2025-54794 is a critical (CVSS 9.1) path validation flaw in Claude Code. A prefix match instead of a canonical path comparison can let access go outside the current working directory. Versions below 0.2.111 are affected; 0.2.111 fixes it. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Claude Code below 0.2.111 is affected, per the record.
- Fixed in 0.2.111.
- The record says exploitation depends on a directory with the same prefix as the working directory existing or being creatable, and on untrusted content reaching the context window.
The record lists CVSS 9.1 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the installed version.
claude --version
If it is below 0.2.111, update through your package manager or the tool's own update command.
What to do now
- Update Claude Code to 0.2.111 or later.
- Treat untrusted text in the context window, such as files and web content from unknown sources, with caution.
- Keep sensitive files out of directories whose names share a prefix with project folders.
- Review agent permission settings for your team.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22. It is the same prefix comparison mistake seen in CVE-2025-54387: a check on the first characters of a path says nothing about whether it is truly inside a folder. Comparing canonical paths closes the gap.
The conditions in the record are narrow. Two things must line up, and the attacker needs to inject content into the context. That is why the advisory is worth reading in full rather than relying on the score alone.
Severity scores are a starting point. The score for this entry is 9.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
What is the fixed version?
0.2.111, per the record.
Does the record say it is exploited in the wild?
No, and it is not flagged as KEV.
Sources
Last reviewed: 18 October 2026.
