CVE-2025-58764 is a critical (CVSS 9.8) flaw in Claude Code, the agentic coding tool. A command parsing error allowed the confirmation prompt to be bypassed so an untrusted command could run. Versions before 1.0.105 are affected. Auto-update users received the fix, and manual updaters should move to 1.0.105 or later.
What's affected
Claude Code versions before 1.0.105, per the record and the GitHub advisory. The fixed version is 1.0.105.
The advisory says reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.
Users on standard auto-update received the fix automatically. The advisory credits the NVIDIA AI Red Team for the report.
How to check if you're exposed
Claude Code ships as an npm package, so check the version directly.
claude --version
npm ls -g @anthropic-ai/claude-code
Anything below 1.0.105 is affected. The advisory says users on standard auto-update received the fix automatically, so the people most likely to be behind are those who pin versions or update by hand, including build images and shared development containers.
What to do now
- Run the claude version command on developer machines, CI images and dev containers.
- Update anything below 1.0.105 to 1.0.105 or the latest version.
- Be careful about the content you let an agent read, such as files from unknown repositories, issues and web pages.
- Keep an allow list of commands the agent may run without asking, and keep it short.
Why it matters
Agentic tools ask for confirmation before they run commands, and that prompt is the main safety control between text the model reads and code the machine executes. The advisory describes an error in command parsing that let a command slip past the check. The weakness is classed as code injection.
The record notes that exploiting it needs untrusted content in the context window. That is a realistic condition for any coding agent that reads repositories, issues and web content, so keep tools current and treat the confirmation prompt as a control worth protecting.
The record classifies the weakness as CWE-94 (Code Injection).
This is a good case for a dependency inventory that includes developer tooling. Agents, editors and command line assistants run with the privileges of the person using them, so they belong on the same patch tracking list as the libraries in your applications.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do auto-updating installations need action?
The advisory says users on standard auto-update received the fix automatically. Verify by running the claude version command.
Is this exploited in the wild?
The record shows it is not on the CISA KEV list, and the advisory does not report exploitation.
Sources
Last reviewed: 18 October 2026.
