{"data":{"id":"9a996049-434b-4b14-9d6d-862998ecdf7d","title":"CVE-2025-54795: Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to…","summary":"CVE-2025-54795 affects Claude Code versions below 1.0.20. An error in command parsing lets an attacker bypass the Claude Code confirmation prompt and trigger execution of an untrusted command, classified as CWE-78. Exploiting it reliably requires the ability to add untrusted content into a Claude Code context window.","solution":"Fixed in version 1.0.20.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54795","publishedAt":"2025-08-05T01:15:42.023Z","cveId":"CVE-2025-54795","cweIds":["CWE-78"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 1.0.20 (fixed: 1.0.20)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code command parsing flaw bypasses confirmation prompt","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01044,"epssCheckedAt":"2026-11-04T12:08:34.493Z","kevDateAdded":null,"advisoryAliases":["GHSA-x56v-x2h6-7j34"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:10.546Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-06-11T18:19:49.429Z","daysToFix":-55,"fixCheckedAt":"2026-10-29T21:44:00.073Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"1.0.20","matchedVersion":"1.0.20","fixReleasedAt":"2025-06-11T18:19:49.429Z","daysToFix":-55,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:59.921Z"}]}}