Executive brief
Claude Code Research Preview is an npm library used for integrating AI-assisted code generation into development environments. A path validation flaw allows attackers to bypass directory restrictions and access files outside the intended working directory if they can create directories with colliding prefixes or inject untrusted content into the code context. This could lead to unauthorized disclosure of sensitive source code, configuration files, or other confidential data stored on the system.
Technical details
The vulnerability stems from improper path validation that relies on prefix matching instead of canonical path comparison (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). An attacker who can create a directory with a name that shares a prefix with the current working directory (CWD) or inject untrusted paths into Claude Code's context window can escape the intended directory boundary. The attack requires network access (interaction with Claude Code) and is contingent on the presence of directory prefix collisions or the ability to inject untrusted content. Successful exploitation grants unauthorized read access to files outside the restricted scope. The fix was released in version 0.2.111 and auto-deployed to users on standard Claude Code auto-update; users on deprecated versions prior to 1.0.24 were forced to update.
Affected products
- Anthropic Claude Code < 0.2.111
Timeline
- 2025-08-04: disclosed
- 2025-08-04: patched: Fix released in version 0.2.111