HighVulnerabilityLLM-specific
CVE-2025-55284: Claude Code confirmation prompt bypass allows network file exfiltration
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-55284
- Published
- Record updated
- Affected
- @anthropic-ai/claude-code < 1.0.4
- Fixed in
- 1.0.4
- released May 28, 2025, 80 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
Claude Code versions prior to 1.0.4 contain an overly broad allowlist of safe commands. This lets an attacker bypass confirmation prompts to read a file and send its contents over the network without user approval. Reliable exploitation requires the ability to insert untrusted content into a Claude Code context window.
Mitigation
Fixed in version 1.0.4. Users on standard auto-update received the fix automatically after release. Versions prior to 1.0.24 are deprecated and have been forced to update, so current users are unaffected.
Topics
Related items
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
- HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
- MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database