Is CVE-2026-25722 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25722 being exploited in the wild.

How severe is CVE-2026-25722?

Medium severity, with a CVSS score of 4, published 6 February 2026.

Which products and versions are affected?

Anthropic Claude Code before 2.0.57; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.57.

Is there a fix for CVE-2026-25722?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25722 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25722?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25722: Anthropic Claude Code command injection via directory traversal

CVE-2026-25722 · Severity: medium · CVSS 4 · Published 2026-02-06

Claude Code is a code generation and execution tool developed by Anthropic. A flaw in its directory validation logic allows attackers to bypass write protections on sensitive folders by using directory change commands, potentially enabling unauthorized file creation or modification within protected directories. Exploitation requires an attacker to inject malicious commands into a Claude Code session.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-25722 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25722 being exploited in the wild.
How severe is CVE-2026-25722?: Medium severity, with a CVSS score of 4, published 6 February 2026.
Which products and versions are affected?: Anthropic Claude Code before 2.0.57; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.57.
Is there a fix for CVE-2026-25722?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25722 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25722?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.0.57 or later
```
npm install @anthropic-ai/claude-code@2.0.57
```

Technical details

Claude Code failed to properly validate directory changes when combined with write operations to protected folders. The vulnerability exists in command injection via directory traversal: an attacker can use the `cd` command to navigate into sensitive directories like `.claude` and then bypass write protection mechanisms, creating or modifying files without user confirmation. Attack vector is network-based with low complexity; exploitation requires user interaction (passive—the user must include untrusted content in the Claude Code context window). Successful exploitation results in confidentiality, integrity, and availability impact to the vulnerable system. The vulnerability was patched in version 2.0.57; users on auto-update received fixes automatically.

Affected products

Anthropic Claude Code before 2.0.57

Identifiers

CVE-2026-25722
GHSA-66q4-vfjg-2qhh

Timeline

2026-02-06: disclosed
2026-02-06: patched: version 2.0.57

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.