Poznaj podatności. Chroń swoje aplikacje.

Wysoka 15.10.2026

CVE-2026-86063

Claude Code: Obejście przypiętego skrótu wtyczki pozwala na ominięcie weryfikacji hasha

Podatność w Claude Code umożliwiała pominięcie weryfikacji przypiętego skrótu commitu podczas instalacji wtyczki za pomocą specjalnie nazwanej gałęzi Git, co prowadziło do instalacji niezweryfikowanego kodu. Zaleca się aktualizację oprogramowania.

npm

@anthropic-ai/claude-code

Wysoka 24.07.2026

CVE-2026-55607

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

npm

@anthropic-ai/claude-code

Średnia 25.06.2026

CVE-2026-46406

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

npm

@anthropic-ai/claude-code

Średnia 17.06.2026

CVE-2026-54316

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

npm

@anthropic-ai/claude-code

Wysoka 24.04.2026

CVE-2026-40068

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Wysoka 21.04.2026

CVE-2026-39861

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

npm

@anthropic-ai/claude-code

Średnia 17.04.2026

CVE-2026-35603

Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

npm

@anthropic-ai/claude-code

Wysoka 19.03.2026

CVE-2026-33068

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

npm

@anthropic-ai/claude-code

Wysoka 06.02.2026

CVE-2026-25725

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

npm

@anthropic-ai/claude-code

Niska 06.02.2026

CVE-2026-25724

Claude Code has Permission Deny Bypass Through Symbolic Links

npm

@anthropic-ai/claude-code

Wysoka 06.02.2026

CVE-2026-25723

Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

npm

@anthropic-ai/claude-code

Wysoka 06.02.2026

CVE-2026-25722

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

npm

@anthropic-ai/claude-code

Wysoka 03.02.2026

CVE-2026-24887

Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

npm

@anthropic-ai/claude-code

Wysoka 03.02.2026

CVE-2026-24053

Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Wysoka 03.02.2026

CVE-2026-24052

Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

npm

@anthropic-ai/claude-code

Średnia 21.01.2026

CVE-2026-21852

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

npm

@anthropic-ai/claude-code

Wysoka 03.12.2025

CVE-2025-66032

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Wysoka 20.11.2025

CVE-2025-64755

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Wysoka 19.11.2025

CVE-2025-65099

Claude Code vulnerable to command execution prior to startup trust dialog

npm

@anthropic-ai/claude-code

Niska 03.10.2025

CVE-2025-59829

Claude Code permission deny bypass through symlink

npm

@anthropic-ai/claude-code

Wysoka 03.10.2025

CVE-2025-59536

Claude Code can execute commands prior to the startup trust dialog

npm

@anthropic-ai/claude-code

Wysoka 24.09.2025

CVE-2025-59828

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

npm

@anthropic-ai/claude-code

Wysoka 10.09.2025

CVE-2025-59041

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

npm

@anthropic-ai/claude-code

Wysoka 10.09.2025

CVE-2025-58764

Claude Code rg vulnerability does not protect against approval prompt bypass

npm

@anthropic-ai/claude-code