CVE-2025-66032 is a command validation flaw in Claude Code before version 1.0.93. Errors in parsing shell commands, related to the IFS variable and short command line flags, let a command bypass read-only validation and run code. The record scores it 9.8 critical, the advisory says high. Update to 1.0.93.
What's affected
Claude Code versions before 1.0.93 are affected, and 1.0.93 contains the fix. The GitHub advisory lists the npm package @anthropic-ai/claude-code with a vulnerable range below 1.0.93, and says users on standard auto-update have received the fix already.
Both sources add a condition. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. In practice that means content the agent reads, such as files from a repository, web pages or tool output, that an attacker could influence.
Here is the severity conflict. The record gives CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical. The GitHub advisory labels the same flaw High. The condition above is a likely reason for the lower label. Both are published, so use both.
How to check if you're exposed
Check the version of the CLI on every machine and image that runs it:
claude --version
npm ls -g @anthropic-ai/claude-code
Anything below 1.0.93 is affected. Check container images, CI runners and shared development servers as well as laptops, since auto-update does not reach images that were built earlier.
Then think about what content your agent reads. If it works on repositories from outside your organization, or fetches web content, the condition in the advisory is easier to meet.
What to do now
- Update Claude Code to 1.0.93 or later, and confirm the version afterward.
- Rebuild images and CI runners that bundle an older version.
- Keep command approval prompts enabled, and read the commands before approving them.
- Be careful with untrusted repositories and web content as input to coding agents. Use a throwaway environment for unfamiliar code.
- Limit the credentials and file access available to the account that runs the agent.
Why it matters
The weakness is CWE-77, command injection. A tool that decides whether a shell command is read-only has to understand shell syntax well, including variables that control word splitting and the many ways a short flag can combine. If the validator and the shell read the same text differently, a command that passes the check can do more than the check allows.
Agentic tools raise the stakes because they run commands on their own and read content from many sources. Validation is one layer. Isolation and least privilege are the layers that still hold when validation fails. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does untrusted content in the context window mean?
It means text the agent reads that someone else could have written, such as repository files, web pages or tool output. The advisory says reliable exploitation needs that.
Why do the record and advisory differ on severity?
The record's 9.8 assumes the attacker needs nothing. The advisory label is High. Both are published, so cite both.
Sources
Last reviewed: 18 October 2026.
