CVE-2026-25722: 
Claude Code vulnerability analysis and mitigation

CVE-2026-25722 is a command injection vulnerability in Anthropic's Claude Code agentic coding tool, titled "Command Injection via Directory Change Bypasses Write Protection." Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders, allowing an attacker to use the cd command to navigate into sensitive directories (e.g., .claude) and bypass write protection to create or modify files without user confirmation. The vulnerability affects all versions of the @anthropic-ai/claude-code npm package below 2.0.57. It was disclosed on February 6, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Anthropic Advisory).

The root cause is improper input validation (CWE-20) combined with OS command injection (CWE-78): Claude Code did not correctly validate the working directory context when processing write operations, allowing a cd command to shift the effective directory into protected folders like .claude before a write is executed. This bypasses the tool's write-protection mechanism, which apparently checks the target path at the time of the write request but does not account for prior directory navigation. Exploitation requires the attacker to inject untrusted content into a Claude Code context window — a precondition consistent with prompt injection or supply-chain attacks targeting AI coding assistants. The vulnerability was reported via HackerOne by researcher nil221 (Anthropic Advisory, GitHub Advisory).

Successful exploitation allows an attacker to create or modify files in protected directories (such as .claude) without user confirmation, undermining the integrity of Claude Code's configuration and potentially enabling persistent manipulation of the tool's behavior. The CVSS v4.0 scoring reflects high impact across confidentiality, integrity, and availability of the vulnerable system. If an attacker can plant malicious configuration or hook files in .claude, they could influence subsequent Claude Code sessions, potentially leading to code execution, data exfiltration, or further lateral movement within the developer's environment (GitHub Advisory, Anthropic Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.149–0.243%, placing it in roughly the 48th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Reliable exploitation requires the ability to inject untrusted content into a Claude Code context window, which limits opportunistic exploitation but remains a realistic threat in prompt injection or malicious repository scenarios.

1. Identify a target: Locate a developer or CI/CD environment running Claude Code versions prior to 2.0.57 (npm package @anthropic-ai/claude-code).
2. Inject untrusted content into the context window: Craft a prompt injection payload — for example, embedded in a malicious code file, README, or repository content that Claude Code is asked to process — that includes shell commands.
3. Navigate to a protected directory: Include a cd .claude (or similar sensitive directory) command within the injected content, causing Claude Code to change its working directory to the protected folder without triggering write-protection checks.
4. Execute a write operation: Follow the directory change with a file creation or modification command (e.g., writing to a configuration file within .claude), which Claude Code executes without prompting the user for confirmation because the write-protection bypass is in effect.
5. Achieve persistence or further compromise: The newly created or modified file in .claude can be used to alter Claude Code's behavior in future sessions, plant malicious hooks, or exfiltrate sensitive data from the developer's environment (Anthropic Advisory, GitHub Advisory).

• File System: Unexpected or newly created files within the .claude directory (e.g., modified configuration files, new hook scripts, or unfamiliar JSON/YAML files) that were not explicitly created by the user.
• File System: Timestamps on files in .claude or other protected directories that do not align with known user activity.
• Logs: Claude Code session logs showing cd commands navigating into .claude or other sensitive directories followed immediately by write operations, particularly without corresponding user confirmation prompts.
• Process: Unusual child processes spawned by the Claude Code Node.js process writing to .claude or other protected paths.
• Network: Outbound connections from the developer workstation to unexpected external hosts shortly after Claude Code processes untrusted repository content, which may indicate data exfiltration following a successful exploit.

Anthropic has patched this vulnerability in Claude Code version 2.0.57. Users on standard Claude Code auto-update received the fix automatically; users performing manual updates should upgrade to version 2.0.57 or later immediately via npm install -g @anthropic-ai/claude-code@latest. As a workaround, avoid processing untrusted or unreviewed content (e.g., third-party repositories, external files) within Claude Code sessions until the patch is applied, and review the .claude directory for any unauthorized file modifications on potentially affected systems (Anthropic Advisory, GitHub Advisory).

The vulnerability was reported to Anthropic via HackerOne by researcher nil221 and was publicly disclosed on February 6, 2026. Social media coverage was noted on Mastodon and Bluesky via The Hacker Wire, indicating moderate community awareness. No significant vendor statements beyond the official advisory or notable independent researcher commentary have been identified at this time (Anthropic Advisory).