claude-code vulnerabilities
CVEs whose affected-version data names the claude-code package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-88968High· 7.7Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code ru…
▾ Twilightanthropics · claude-codeEPSS 0.32%via CVEORG
CVE-2026-88066High· 7.5Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a ma…
▾ Twilightanthropics · claude-codeEPSS 0.25%via CVEORG