CVE-2025-58764: 
JavaScript vulnerability analysis and mitigation

CVE-2025-58764 is a command injection vulnerability in Anthropic's Claude Code agentic coding tool that allows bypassing the user confirmation prompt to execute untrusted commands without approval. The flaw affects all versions of the @anthropic-ai/claude-code npm package prior to 1.0.105. It was discovered by the NVIDIA AI Red Team, published on September 9, 2025, and disclosed publicly on September 10, 2025. The vulnerability carries a CVSS v4 base score of 8.7 (High) and a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Github Advisory).

The root cause is an error in command parsing within Claude Code's rg (ripgrep) command handling, classified as CWE-94 (Improper Control of Generation of Code / Code Injection). Due to insufficient neutralization of special elements in the parsed command, an attacker can craft malicious content that, when introduced into the Claude Code context window, causes the tool to execute untrusted shell commands while bypassing the built-in user approval/confirmation prompt. The primary precondition for exploitation is the ability to inject untrusted content into the Claude Code context window — for example, via a malicious file, repository, or prompt injection in content Claude Code is asked to process (GitHub Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary commands on the system running Claude Code without triggering the user confirmation prompt that serves as the primary safety control. This can result in full compromise of confidentiality, integrity, and availability of the affected system — including unauthorized access to sensitive source code and credentials, modification or deletion of files, and disruption of the development environment. Because Claude Code typically runs with the privileges of the developer's user account, exploitation could enable lateral movement within a development environment or CI/CD pipeline (GitHub Advisory).

There is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability was responsibly reported by the NVIDIA AI Red Team. The EPSS score is approximately 0.118% (per Feedly data), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires passive user interaction — specifically, a user must process attacker-controlled content within Claude Code — which somewhat limits opportunistic exploitation.

1. Identify a target: Locate a developer or organization using Claude Code versions prior to 1.0.105 in their workflow.
2. Craft malicious content: Prepare a file, code repository, or other content containing a specially crafted payload that exploits the rg command parsing error. The payload is designed to inject shell commands that bypass the confirmation prompt when parsed by Claude Code.
3. Deliver content to the context window: Introduce the malicious content into the Claude Code context window — for example, by submitting a malicious pull request, sharing a crafted file for review, or leveraging prompt injection in content Claude Code is asked to analyze.
4. Trigger command execution: When Claude Code processes the malicious content and invokes the rg command with the crafted input, the parsing error causes the injected command to execute on the host system without presenting the user approval prompt.
5. Achieve objective: The injected command runs with the privileges of the Claude Code process (typically the developer's user account), enabling data exfiltration, file manipulation, reverse shell establishment, or further lateral movement (GitHub Advisory).

• Process: Unexpected child processes spawned by the Claude Code Node.js process (e.g., sh, bash, curl, wget, python, nc) without corresponding user-initiated actions.
• Logs: Shell history or audit logs showing commands executed without a corresponding user confirmation event in Claude Code session logs; unexpected rg invocations with unusual arguments containing shell metacharacters or command separators.
• File System: New or modified files in the project directory or user home directory not attributable to normal Claude Code operations; unexpected scripts, cron jobs, or SSH authorized_keys modifications created under the developer's account.
• Network: Outbound network connections from the Claude Code process to unexpected external IP addresses or domains, particularly shortly after processing external content.

Anthropic has released version 1.0.105 of @anthropic-ai/claude-code which addresses this vulnerability. Users on standard Claude Code auto-update will have received the fix automatically. Users performing manual updates should upgrade to version 1.0.105 or later immediately via npm install -g @anthropic-ai/claude-code. As a general precaution, users should avoid processing untrusted or unvetted content within Claude Code sessions until the patch is applied, and should enable automatic updates to ensure timely receipt of future security fixes (GitHub Advisory, Github Advisory).

The vulnerability was credited to the NVIDIA AI Red Team, highlighting growing security research focus on agentic AI coding tools (GitHub Advisory). Social media activity on Bluesky noted the disclosure, and security aggregators including INCIBE, Red Hat, and GitLab advisories tracked the issue. The vulnerability attracted attention in the broader AI security community as an example of prompt injection and command injection risks inherent in agentic AI tools that interact with the host operating system.