CVE-2025-54794

CRITICAL

Claude Code < 0.2.111 - Path Traversal via Prefix Matching Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-54794. PoCs published by AdityaBhatt3010.

AI-analyzed exploit summary Technical analysis of CVE-2025-54794, a prompt injection vulnerability in Claude AI that allows attackers to override system instructions via crafted code blocks, leading to unauthorized data leakage or behavior manipulation.

Description

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111.

Exploits (1)

nomisec WRITEUP 12 stars
by AdityaBhatt3010 · poc
https://github.com/AdityaBhatt3010/CVE-2025-54794-Hijacking-Claude-AI-with-a-Prompt-Injection-The-Jailbreak-That-Talked-Back

Technical analysis of CVE-2025-54794, a prompt injection vulnerability in Claude AI that allows attackers to override system instructions via crafted code blocks, leading to unauthorized data leakage or behavior manipulation.

Classification
Writeup 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Claude AI (Anthropic)
No auth needed
Prerequisites: Access to Claude AI input interface (chat, file upload, etc.)
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.1
EPSS 0.0038
EPSS Percentile 60.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (2)
anthropic/claude_code < 0.2.111
anthropic-ai/claude-code 0 - 0.2.111npm
Published Aug 05, 2025
Tracked Since Feb 18, 2026