CVE-2025-58764: Anthropic Claude Code RCE Vulnerability

CVE-2025-58764 Overview

CVE-2025-58764 is a Code Injection vulnerability affecting Anthropic Claude Code, an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt, which could be exploited to trigger execution of an untrusted command. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code).

Reliably exploiting this vulnerability requires the ability to add untrusted content into a Claude Code context window. An attacker who can influence the content processed by Claude Code could potentially bypass security confirmations and execute arbitrary commands without user approval.

Critical Impact
Successful exploitation allows attackers to bypass confirmation prompts and execute untrusted commands, potentially leading to unauthorized code execution, data exfiltration, or system compromise.

Affected Products

Anthropic Claude Code versions prior to 1.0.105
Claude Code for Node.js environments

Discovery Timeline

2025-09-10 - CVE-2025-58764 published to NVD
2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-58764

Vulnerability Analysis

This vulnerability stems from improper handling of command parsing within Claude Code's execution pipeline. The tool is designed to present users with confirmation prompts before executing potentially dangerous commands, serving as a security boundary between the AI agent and the underlying system. However, a flaw in the command parsing logic allowed specially crafted input to bypass this confirmation mechanism entirely.

The attack surface requires an adversary to inject untrusted content into Claude Code's context window. This could occur through various vectors such as malicious project files, compromised dependencies, or manipulated input sources that Claude Code processes during its agentic operations.

Root Cause

The root cause is an error in command parsing logic (CWE-94: Improper Control of Generation of Code). The vulnerability exists in how Claude Code interprets and validates commands before presenting them to users for confirmation. Certain command structures or character sequences were not properly sanitized, allowing the confirmation prompt to be bypassed.

Attack Vector

The attack is conducted over the network and requires some user interaction. An attacker must first establish a means to inject content into a Claude Code session's context window. This could be achieved through:

Malicious code repositories or project files that Claude Code analyzes
Compromised external data sources referenced during coding tasks
Social engineering to convince users to process attacker-controlled content

Once untrusted content is present in the context window, the parsing flaw allows command execution without the expected user confirmation, breaking the trust boundary the confirmation prompt is designed to enforce.

The vulnerability mechanism involves malformed or specially crafted command sequences that exploit the parsing error. When Claude Code processes these sequences, the confirmation prompt that normally protects against unintended command execution is bypassed. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-58764

Indicators of Compromise

Unexpected command executions in Claude Code session logs without corresponding user confirmations
Anomalous system calls or process spawning originating from Claude Code processes
Presence of suspicious content in Claude Code context windows or input sources

Detection Strategies

Monitor Claude Code execution logs for commands that lack confirmation entries
Implement process monitoring to detect unexpected child processes spawned by Claude Code
Audit input sources and project files for potentially malicious content patterns

Monitoring Recommendations

Enable verbose logging for Claude Code sessions to capture command execution flows
Deploy endpoint detection to monitor for suspicious process trees originating from Node.js processes running Claude Code
Review auto-update status to ensure Claude Code instances are receiving security patches

How to Mitigate CVE-2025-58764

Immediate Actions Required

Update Claude Code to version 1.0.105 or later immediately
Verify auto-update functionality is enabled and working correctly
Audit recent Claude Code sessions for any signs of unauthorized command execution

Patch Information

Anthropic has released version 1.0.105 which addresses this command parsing vulnerability. Users on standard Claude Code auto-update should have received this fix automatically. Manual update users should upgrade to version 1.0.105 or the latest available version.

For complete patch details and security advisory information, see the GitHub Security Advisory for GHSA-qxfv-fcpc-w36x.

Workarounds

Limit Claude Code's exposure to untrusted content sources until patched
Exercise caution when using Claude Code with repositories or projects from untrusted sources
Consider disabling Claude Code in sensitive environments until the update is applied

bash

# Verify Claude Code version
claude --version

# Manual update if auto-update is disabled
npm update -g @anthropic-ai/claude-code

# Verify updated version is 1.0.105 or later
claude --version