Schwachstellen verstehen. Anwendungen schützen.

Hoch 15.10.2026

CVE-2026-86063

Claude Code: Umgehung des Plugin-Hash-Pinnings ermöglicht Hash-Pin-Bypass

Eine Schwachstelle in Claude Code ermöglichte das Umgehen des Hash-Pinnings bei der Plugin-Installation über speziell benannte Git-Branches, was zur Ausführung von durch Angreifer kontrolliertem Code führen konnte. Benutzern wird ein Update empfohlen.

npm

@anthropic-ai/claude-code

Hoch 24.07.2026

CVE-2026-55607

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

npm

@anthropic-ai/claude-code

Mittel 25.06.2026

CVE-2026-46406

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

npm

@anthropic-ai/claude-code

Mittel 17.06.2026

CVE-2026-54316

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

npm

@anthropic-ai/claude-code

Hoch 24.04.2026

CVE-2026-40068

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Hoch 21.04.2026

CVE-2026-39861

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

npm

@anthropic-ai/claude-code

Mittel 17.04.2026

CVE-2026-35603

Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

npm

@anthropic-ai/claude-code

Hoch 19.03.2026

CVE-2026-33068

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

npm

@anthropic-ai/claude-code

Hoch 06.02.2026

CVE-2026-25725

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

npm

@anthropic-ai/claude-code

Niedrig 06.02.2026

CVE-2026-25724

Claude Code has Permission Deny Bypass Through Symbolic Links

npm

@anthropic-ai/claude-code

Hoch 06.02.2026

CVE-2026-25723

Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

npm

@anthropic-ai/claude-code

Hoch 06.02.2026

CVE-2026-25722

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

npm

@anthropic-ai/claude-code

Hoch 03.02.2026

CVE-2026-24887

Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

npm

@anthropic-ai/claude-code

Hoch 03.02.2026

CVE-2026-24053

Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Hoch 03.02.2026

CVE-2026-24052

Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

npm

@anthropic-ai/claude-code

Mittel 21.01.2026

CVE-2026-21852

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

npm

@anthropic-ai/claude-code

Hoch 03.12.2025

CVE-2025-66032

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Hoch 20.11.2025

CVE-2025-64755

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Hoch 19.11.2025

CVE-2025-65099

Claude Code vulnerable to command execution prior to startup trust dialog

npm

@anthropic-ai/claude-code

Niedrig 03.10.2025

CVE-2025-59829

Claude Code permission deny bypass through symlink

npm

@anthropic-ai/claude-code

Hoch 03.10.2025

CVE-2025-59536

Claude Code can execute commands prior to the startup trust dialog

npm

@anthropic-ai/claude-code

Hoch 24.09.2025

CVE-2025-59828

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

npm

@anthropic-ai/claude-code

Hoch 10.09.2025

CVE-2025-59041

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

npm

@anthropic-ai/claude-code

Hoch 10.09.2025

CVE-2025-58764

Claude Code rg vulnerability does not protect against approval prompt bypass

npm

@anthropic-ai/claude-code