Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

緊急 9.1CVE-2025-54794 · GHSA-pmw4-pwvc-3hx2 · 05/08/2025 公開 · 17/06/2026 更新

要点

CVE-2025-54794 は claude code (anthropic), @anthropic-ai/claude-code に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 72.3% より高い）。
対処：0.2.111 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
claude code anthropic	`< 0.2.111`	`0.2.111`
@anthropic-ai/claude-code npm	`< 0.2.111`	`0.2.111`

概要

Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window.

Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update.

Thank you to Elad Beber (Cymulate) for reporting this issue!

NVD の説明

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111.