{"data":{"id":"8d220d89-eb6e-469d-93d6-3605efc35639","title":"CVE-2025-66032: Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and…","summary":"CVE-2025-66032 affects Claude Code, an agentic coding tool, before version 1.0.93. Errors in parsing shell commands related to $IFS and short CLI flags let an attacker bypass the read-only validation and trigger arbitrary code execution. Exploiting it reliably requires the ability to add untrusted content into the Claude Code context window.","solution":"Fixed in 1.0.93.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66032","publishedAt":"2025-12-03T19:15:57.527Z","cveId":"CVE-2025-66032","cweIds":["CWE-77"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 1.0.93 (fixed: 1.0.93)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code command injection via shell parsing of $IFS and short flags","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00738,"epssCheckedAt":"2026-11-04T12:08:34.091Z","kevDateAdded":null,"advisoryAliases":["GHSA-xq4m-mc3c-vvg3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:50.540Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-26T22:22:24.524Z","daysToFix":-99,"fixCheckedAt":"2026-10-29T21:42:23.839Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"1.0.93","matchedVersion":"1.0.93","fixReleasedAt":"2025-08-26T22:22:24.524Z","daysToFix":-99,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:23.690Z"}]}}