# CVE-2026-25722: Anthropic Claude Code command injection via directory traversal

Source: https://junglewise.ai/threats/cve-2026-25722-anthropic-claude-code-command-injection-via-directory-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25722 · Severity: medium · CVSS 4 · Published 2026-02-06

Claude Code is a code generation and execution tool developed by Anthropic. A flaw in its directory validation logic allows attackers to bypass write protections on sensitive folders by using directory change commands, potentially enabling unauthorized file creation or modification within protected directories. Exploitation requires an attacker to inject malicious commands into a Claude Code session.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25722 being exploited in the wild.

**How severe is CVE-2026-25722?** Medium severity, with a CVSS score of 4, published 6 February 2026.

**Which products and versions are affected?** Anthropic Claude Code before 2.0.57; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.57.

**Is there a fix for CVE-2026-25722?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25722 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25722?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.0.57 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.0.57
  ```


## Technical details

Claude Code failed to properly validate directory changes when combined with write operations to protected folders. The vulnerability exists in command injection via directory traversal: an attacker can use the `cd` command to navigate into sensitive directories like `.claude` and then bypass write protection mechanisms, creating or modifying files without user confirmation. Attack vector is network-based with low complexity; exploitation requires user interaction (passive—the user must include untrusted content in the Claude Code context window). Successful exploitation results in confidentiality, integrity, and availability impact to the vulnerable system. The vulnerability was patched in version 2.0.57; users on auto-update received fixes automatically.

## Affected products

- Anthropic Claude Code before 2.0.57

## Identifiers

- CVE-2026-25722
- GHSA-66q4-vfjg-2qhh

## Timeline

- 2026-02-06: disclosed
- 2026-02-06: patched: version 2.0.57

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh](https://github.com/anthropics/claude-code/security/advisories/GHSA-66q4-vfjg-2qhh)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)