Anthropic security advisories

40 advisories across Anthropic

Date	Advisory	Severity	Fixed in
Sep 25	Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host High8.5Sep 25 GHSA-v234-4jrq-mgg61.15962.0	High8.5	1.15962.0
Sep 12	Argument Injection via resume Option Allows Arbitrary Command Execution Critical9.2Sep 12 CVE-2026-966200.2.121	Critical9.2	0.2.121
Jul 1	Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation Medium6.3Jul 1 CVE-2026-554070.8.0+1 more	Medium6.3	0.8.0+1 more
Jul 1	Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref Medium5.9Jul 1 CVE-2026-554060.7.0	Medium5.9	0.7.0
Jun 25	Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write Medium4.4Jun 25 CVE-2026-464062.1.128	Medium4.4	2.1.128
Jun 25	Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution High7.7Jun 25 CVE-2026-556072.1.163	High7.7	2.1.163
Jun 13	Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch Medium6.0Jun 13 CVE-2026-543162.1.163	Medium6.0	2.1.163
May 20	Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration Medium5.3May 20 CVE-2026-477511.0.74	Medium5.3	1.0.74
May 6	SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions High7.4May 6 CVE-2026-444671.4304.0	High7.4	1.4304.0
May 6	Local Privilege Escalation via Directory Junction in CoworkVMService High8.5May 6 CVE-2026-444701.3834.0	High8.5	1.3834.0
Apr 24	Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool Medium4.8Apr 24 CVE-2026-416860.91.1	Medium4.8	0.91.1
Apr 24	Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution High7.7Apr 24 CVE-2026-400682.1.84	High7.7	2.1.84
Apr 20	Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace High7.7Apr 20 CVE-2026-398612.1.64	High7.7	2.1.64
Apr 17	Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows Medium5.4Apr 17 CVE-2026-356032.1.75	Medium5.4	2.1.75
Mar 31	Memory Tool Path Validation Race Condition Allows Sandbox Escape Medium5.8Mar 31 CVE-2026-344520.87.0	Medium5.8	0.87.0
Mar 31	Insecure Default File Permissions in Local Filesystem Memory Tool Medium4.8Mar 31 CVE-2026-344500.87.0	Medium4.8	0.87.0
Mar 31	Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories Medium6.3Mar 31 CVE-2026-344510.81.0	Medium6.3	0.81.0
Mar 18	Workspace Trust Dialog Bypass via Repo-Controlled Settings File High7.7Mar 18 CVE-2026-330682.1.53	High7.7	2.1.53
Feb 6	Command Injection via Directory Change Bypasses Write Protection High7.7Feb 6 CVE-2026-25722v2.0.57	High7.7	v2.0.57
Feb 6	Command Injection via Piped sed Command Bypasses File Write Restrictions High7.7Feb 6 CVE-2026-25723v2.0.55	High7.7	v2.0.55
Feb 6	Sandbox Escape via Persistent Configuration Injection in settings.json High7.7Feb 6 CVE-2026-25725v2.1.2	High7.7	v2.1.2
Feb 6	Permission Deny Bypass Through Symbolic Links Low2.3Feb 6 CVE-2026-25724v2.1.7	Low2.3	v2.1.7
Feb 3	Command Injection in find Command Bypasses User Approval Prompt High7.7Feb 3 CVE-2026-24887v2.0.72	High7.7	v2.0.72
Feb 3	Path Restriction Bypass via ZSH Clobber Allows Arbitrary File Writes High7.7Feb 3 CVE-2026-24053v2.0.74	High7.7	v2.0.74
Feb 3	Domain Validation Bypass Allows Automatic Requests to Attacker-Controlled Domains High7.1Feb 3 CVE-2026-24052v1.0.111	High7.1	v1.0.111
Jan 20	Anthropic: information disclosure Medium5.3Jan 20 CVE-2026-21852v2.0.65	Medium5.3	v2.0.65
Dec 42025	Network Sandboxing Escape Low1.8Dec 4, 2025 CVE-2025-664790.0.16	Low1.8	0.0.16
Dec 32025	Command Validation Bypass Allows Arbitrary Code Execution High8.7Dec 3, 2025 CVE-2025-66032v1.0.93	High8.7	v1.0.93
Nov 202025	Sed Command Validation Bypass Allows Arbitrary File Writes High8.7Nov 20, 2025 CVE-2025-64755v2.0.31	High8.7	v2.0.31
Nov 192025	Command execution prior to Claude Code startup trust dialog High7.7Nov 19, 2025 CVE-2025-65099v1.0.39	High7.7	v1.0.39
Oct 32025	Command execution prior to Claude Code startup trust dialog High8.7Oct 3, 2025 CVE-2025-59536v1.0.111	High8.7	v1.0.111
Oct 32025	Permission deny bypass through symlink Low2.3Oct 3, 2025 CVE-2025-59829v1.0.120	Low2.3	v1.0.120
Sep 242025	Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions High7.7Sep 24, 2025 CVE-2025-59828v1.0.39	High7.7	v1.0.39
Sep 92025	Command Injection in Claude Code rg command allowed bypass of user approval prompt for command execution High8.7Sep 9, 2025 CVE-2025-587641.0.105	High8.7	1.0.105
Sep 92025	Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email High8.7Sep 9, 2025 CVE-2025-590411.0.105	High8.7	1.0.105
Sep 22025	Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning High8.7Sep 2, 2025 GHSA-ph6w-f82w-28w6v1.0.87	High8.7	v1.0.87
Aug 152025	Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code High7.1Aug 15, 2025 CVE-2025-55284v1.0.4	High7.1	v1.0.4
Aug 12025	Anthropic: path traversal High7.7Aug 1, 2025 CVE-2025-54794v0.2.111	High7.7	v0.2.111
Aug 12025	Command Injection in Claude Code echo command allowed bypass of user approval prompt for command execution High8.7Aug 1, 2025 CVE-2025-54795v1.0.20	High8.7	v1.0.20
Jun 232025	Claude Code IDE extensions allow websocket connections from arbitrary origins High8.8Jun 23, 2025 CVE-2025-528821.0.24andabove+2 more	High8.8	1.0.24andabove+2 more

About Anthropic

Anthropic, PBC is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California. Its flagship product is Claude, a series of proprietary large language models (LLMs).

Elsewhere on fru.dev: Acquisitions · Funding · Paydays · Releases · TechConf · Trending

Critical advisories by email