CVE-2025-64755: Claude Code Privilege Escalation Flaw

CVE-2025-64755 Overview

CVE-2025-64755 is a command injection vulnerability affecting Anthropic Claude Code, an agentic coding tool. Prior to version 2.0.31, a flaw in sed command parsing allowed attackers to bypass the Claude Code read-only validation mechanism and write to arbitrary files on the host system. This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating a command injection weakness.

Critical Impact

Successful exploitation enables attackers to bypass security controls and achieve arbitrary file write capabilities on the host system, potentially leading to code execution, data tampering, or system compromise.

Affected Products

• Anthropic Claude Code versions prior to 2.0.31
• Claude Code for Node.js (all affected versions)

Discovery Timeline

• 2025-11-21 - CVE-2025-64755 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-64755

Vulnerability Analysis

This vulnerability stems from improper handling of sed command parsing within Claude Code's security validation layer. The application implements a read-only validation mechanism designed to prevent write operations to the file system. However, due to flawed parsing logic when processing sed commands, attackers can craft malicious input that circumvents these protective controls.

The command injection vulnerability allows an attacker to escape the intended command context and inject arbitrary file write operations. Since Claude Code operates as an agentic coding tool with system access, the impact of bypassing its security boundaries is significant—attackers gain the ability to modify configuration files, inject malicious code, or compromise sensitive data on the host.

Root Cause

The root cause is an error in the sed command parsing implementation that fails to properly validate and sanitize user-controlled input before execution. The parsing logic does not correctly identify or neutralize special characters and command sequences that can be abused to break out of the read-only context. This allows attackers to inject commands that the validation layer does not recognize as write operations.

Attack Vector

The attack is network-based and requires user interaction. An attacker can exploit this vulnerability by providing specially crafted input to Claude Code that includes malicious sed command syntax. When the application processes this input through its flawed parser, the injected commands bypass the read-only validation and execute with write permissions on the host file system.

The exploitation flow involves:

1. Attacker crafts input containing sed command injection payload
2. Claude Code's parser fails to properly validate the malicious input
3. The payload bypasses read-only validation checks
4. Arbitrary file write operations execute on the host system

For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2025-64755

Indicators of Compromise

• Unexpected file modifications in system directories or application paths
• Unusual sed command execution patterns in process logs
• Write operations to files that should be read-only under Claude Code's security model
• Anomalous file system activity from Claude Code processes

Detection Strategies

• Monitor Claude Code process activity for unexpected file write operations
• Implement file integrity monitoring (FIM) on critical system and application files
• Review application logs for malformed or suspicious sed command patterns
• Deploy endpoint detection solutions capable of identifying command injection behavior

Monitoring Recommendations

• Enable verbose logging for Claude Code operations where available
• Establish baselines for normal Claude Code file system activity
• Alert on file modifications outside expected working directories
• Monitor for process spawning patterns indicative of command injection

How to Mitigate CVE-2025-64755

Immediate Actions Required

• Upgrade Anthropic Claude Code to version 2.0.31 or later immediately
• Audit systems running affected versions for signs of exploitation
• Review file system for unauthorized modifications
• Restrict network access to Claude Code instances until patched

Patch Information

Anthropic has addressed this vulnerability in Claude Code version 2.0.31. Organizations should update to this version or later to remediate the command injection flaw. The patch corrects the sed command parsing logic to properly validate input and enforce read-only restrictions.

For complete patch details and installation instructions, refer to the GitHub Security Advisory (GHSA-7mv8-j34q-vp7q).

Workarounds

• Restrict Claude Code usage to trusted environments until the patch is applied
• Implement network segmentation to limit exposure of affected systems
• Use file system permissions to protect critical directories from write operations
• Consider temporarily disabling Claude Code functionality that processes external input

# Update Claude Code to patched version
npm update @anthropic/claude-code@2.0.31

# Verify installed version
npm list @anthropic/claude-code