{"data":{"id":"e712d271-ec22-463c-badc-3a1536d6fab5","title":"CVE-2025-59829: Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission…","summary":"Claude Code versions below 1.0.120 did not account for symlinks when checking permission deny rules. If a user denied Claude Code access to a file, but Claude Code could reach a symlink pointing to that file, Claude Code could still access the file.","solution":"Fixed in version 1.0.120. Standard auto-update installs the fix automatically; users performing manual updates are advised to update to the latest version.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59829","publishedAt":"2025-10-03T20:15:33.653Z","cveId":"CVE-2025-59829","cweIds":["CWE-61"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 1.0.120 (fixed: 1.0.120)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code permission deny rules bypassed via symlinks","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00447,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":["GHSA-66m2-gx93-v996"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:25.381Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-09-19T21:08:21.676Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:43:33.427Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"1.0.120","matchedVersion":"1.0.120","fixReleasedAt":"2025-09-19T21:08:21.676Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:33.276Z"}]}}