CVE-2025-58764

UNKNOWN

Published Unknown

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-58764. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

EUVD ID

View on ENISA

ENISA Analysis

Malicious code in bioql (PyPI)

Affected Products (ENISA)

anthropics

claude-code

ENISA Scoring

CVSS Score (4.0)

8.7

/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.120

probability

ENISA References

https://github.com/anthropics/claude-code/security/advisories/GHSA-qxfv-fcpc-w36x

Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Claude Code rg vulnerability does not protect against approval prompt bypass

GHSA-qxfv-fcpc-w36x

Advisory Details

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Thank you to the NVIDIA AI Red Team for reporting this issue!

Affected Packages

npm @anthropic-ai/claude-code

ECOSYSTEM: ≥0 <1.0.105

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

WEB https://github.com/anthropics/claude-code/security/advisories/GHSA-qxfv-fcpc-w36x

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-58764

PACKAGE https://github.com/anthropics/claude-code

Advisory provided by GitHub Security Advisory Database. Published: September 10, 2025, Modified: September 10, 2025

Published: Unknown

Last Modified: Unknown

Copied to clipboard!