CVE-2025-64755 is a command validation flaw in Claude Code, Anthropic's agentic coding tool. Before version 2.0.31, an error in sed command parsing let a command pass the read-only check and write to arbitrary files. The record scores it 9.8 critical, the advisory says high. Update to 2.0.31 or later.
What's affected
Claude Code versions before 2.0.31 are affected, and 2.0.31 contains the fix. The GitHub advisory lists the npm package @anthropic-ai/claude-code with a vulnerable range below 2.0.31.
The advisory says users on standard auto-update received the fix automatically, and that people who update by hand should move to the latest version.
Here is the severity conflict. The record carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical. The GitHub advisory for the same issue is labeled High. Both ratings are published, so this post gives both. The description itself is brief. Because of an error in how sed commands were parsed, it was possible to get past the tool's read-only validation and write to arbitrary files on the host.
How to check if you're exposed
Check the installed version of the CLI. Either of these works:
claude --version
npm ls -g @anthropic-ai/claude-code
If you install Claude Code per project or in a container image, check those images and lockfiles too. A CI image that was built months ago may still carry an older version, even if laptops auto-updated.
What to do now
- Update Claude Code to 2.0.31 or later. If you use auto-update, confirm it actually ran by checking the version.
- Rebuild any container or CI image that bakes in an older version.
- Pin a minimum version in your developer tooling policy so older installs are flagged.
- Keep the approval prompts on. Read-only validation is one layer, and human review of commands is another.
- Run coding agents under an account and in a directory with only the access they need.
Why it matters
The weakness is listed as CWE-78, OS command injection. Agentic tools often decide whether a shell command is safe by parsing it. If the parser and the shell disagree about what a command means, an allowlist of read-only commands can be bypassed. That is a hard problem for any tool that wraps a shell.
The impact here is a write primitive, so a command that looked like a read could change files. That is why the record rates it so high, and why the advisory still treats it as serious. The record does not say it was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Why does the record say critical when the advisory says high?
They score the same flaw with different assumptions. The record's 9.8 assumes network access and no privileges. The advisory's High label comes from the maintainer. Both are published, so cite both.
Do I have to do anything if auto-update is on?
Confirm the version. The advisory says auto-update users received the fix, but a quick version check proves it.
Sources
Last reviewed: 18 October 2026.
