CVE-2025-54794

CRITICAL

Anthropic Claude Code < 0.2.111 - Path Traversal

Title source: rule

Description

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111.

Exploits (1)

nomisec WRITEUP 12 stars

by AdityaBhatt3010 · poc

https://github.com/AdityaBhatt3010/CVE-2025-54794-Hijacking-Claude-AI-with-a-Prompt-Injection-The-Jailbreak-That-Talked-Back

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://github.com/anthropics/claude-code/security/advisories/GHSA-pmw4-pwvc-3hx2

Scores

CVSS v3 9.1

EPSS 0.0009

EPSS Percentile 25.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-22

Status published

Products (2)

anthropic/claude_code < 0.2.111

anthropic-ai/claude-code 0 - 0.2.111npm

Published Aug 05, 2025

Tracked Since Feb 18, 2026