CVE-2025-54795 is a critical command injection flaw in Claude Code, Anthropic's agentic coding tool. A command parsing error before version 1.0.20 can bypass the confirmation prompt and run an untrusted command. The fix shipped in version 1.0.20, and the maintainers say standard auto-update users received it automatically.
What's affected
- Product: Claude Code, distributed as the npm package
@anthropic-ai/claude-code. - Affected: versions below 1.0.20.
- Fixed: version 1.0.20.
- Precondition: the record says reliable exploitation requires the ability to add untrusted content into a Claude Code context window. Think of a cloned repository, a pasted file, a web page the tool fetched, or any other text the assistant reads.
The GitHub advisory adds that users on standard auto-update received the fix automatically, and that versions before 1.0.24 are deprecated and have been forced to update. Treat that as the vendor's statement, and confirm the version on each machine rather than assuming.
How to check if you're exposed
Check the installed version on each developer machine and on any CI runner or container image that has the tool baked in.
claude --version
npm ls -g @anthropic-ai/claude-code
Anything reporting 1.0.19 or lower is in the affected range. In images, look for the package in your lockfiles or run the same command inside the container. Auto-update does not help pinned installs, so pay attention to Dockerfiles and bootstrap scripts that install a fixed version.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE. Add developer tooling images to your scan targets, since these tools often live outside the application manifest.
What to do now
- Update to the latest release, and at minimum 1.0.20:
npm install -g @anthropic-ai/claude-code@latest. - Find pinned or baked installs in Dockerfiles, devcontainer definitions and setup scripts, and bump them.
- Until every machine is confirmed updated, avoid pointing the tool at repositories or documents you do not trust.
- Keep the confirmation prompt on. It is the control this flaw bypassed, so do not rely on it alone for untrusted content; run the tool in a sandbox or container for unfamiliar code.
- Add the package to your dependency inventory so the next advisory shows up with an owner attached.
Why it matters
The class here is OS command injection. The tool is supposed to show a human the command and wait for approval. A parsing error meant the text the user approved was not the whole story of what would run. The prompt is a trust boundary, and any mistake in how a command string is split or interpreted can quietly widen what the approval covers.
Agentic tools raise the stakes because their input is not only what the user types. Content the model reads can steer the commands it proposes, which is why the record stresses the untrusted context precondition. The advisory rates the issue High under CVSS 4.0 (8.7) while the NVD record scores 9.8 under CVSS 3.1, so expect different severity labels in different tools. The fix is the same either way. This CVE is not on the CISA KEV list.
The weakness is classed as CWE-78 (OS Command Injection). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Try it yourself
This walk-through shows how a new advisory is picked up and matched against what you actually run.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to do anything if auto-update is on?
Check anyway. The advisory says standard auto-update users received the fix, but pinned installs, containers and offline machines may not have updated. Run the version command and confirm 1.0.20 or later.
Can this be triggered with no untrusted content in the session?
The record says reliable exploitation requires the ability to add untrusted content into the context window. Keeping the tool away from content you do not trust reduces exposure, but updating is the actual fix.
Sources
Last reviewed: 18 October 2026.
