{"data":{"id":"c2311ad6-a0fa-46c9-bc79-40cbd4b8c498","title":"CVE-2026-25724: Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules…","summary":"Claude Code, an agentic coding tool, failed to strictly enforce deny rules set in settings.json when accessing files through symbolic links. A user's explicit denial of a file such as /etc/passwd could be bypassed by reading that file through a symlink pointing to it. The issue is tracked as CVE-2026-25724 and affects versions prior to 2.1.7.","solution":"This issue has been patched in version 2.1.7.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25724","publishedAt":"2026-02-06T18:16:00.037Z","cveId":"CVE-2026-25724","cweIds":["CWE-61","CWE-285"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 2.1.7 (fixed: 2.1.7)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code deny rules bypassed through symbolic links","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00475,"epssCheckedAt":"2026-11-04T18:09:13.116Z","kevDateAdded":null,"advisoryAliases":["GHSA-4q92-rfm6-2cqx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:01.071Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-01-13T22:55:49.806Z","daysToFix":-24,"fixCheckedAt":"2026-10-29T21:41:47.133Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"2.1.7","matchedVersion":"2.1.7","fixReleasedAt":"2026-01-13T22:55:49.806Z","daysToFix":-24,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:41:46.984Z"}]}}