~ / search / GHSA-7mv8-j34q-vp7q

GHSA-7mv8-j34q-vp7q

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

Source: GitHub Advisory Database (reviewed) High CVE-2025-64755

Packages

EcosystemPackageAffectedFixed in
npm @anthropic-ai/claude-code < 2.0.31 2.0.31

Details

As written in the advisory (Markdown source, shown as plain text).

Due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Thank you to Adam Chester - SpecterOps for reporting this issue!

References

External links from the advisory. They lead to third-party sites.