@anthropic-ai/claude-code (npm)
Advisories
29
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.1.179 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @anthropic-ai/claude-code@2.1.179yarn
yarn add @anthropic-ai/claude-code@2.1.179pnpm
pnpm add @anthropic-ai/claude-code@2.1.179Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pq7j-f95f-qfcv Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning |
High EPSS 0.17% |
< 2.1.179 | 2.1.179 |
| GHSA-7835-87q9-rgvv Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution |
High EPSS 0.69% |
>= 2.1.38, < 2.1.163 | 2.1.163 |
| GHSA-4vp2-6q8c-pvq2 @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write |
Medium EPSS 0.15% |
>= 2.1.59, < 2.1.128 | 2.1.128 |
| GHSA-fg94-h982-f3mm Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch |
Critical EPSS 0.52% |
>= 0.2.54, < 2.1.163 | 2.1.163 |
| GHSA-q5hj-mxqh-vv77 Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution |
High EPSS 0.31% |
>= 2.1.63, < 2.1.84 | 2.1.84 |
| GHSA-vp62-r36r-9xqp Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace |
Critical EPSS 0.71% |
< 2.1.64 | 2.1.64 |
| GHSA-5cwg-9f6j-9jvx Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows |
High EPSS 0.11% |
< 2.1.75 | 2.1.75 |
| GHSA-mmgp-wc2j-qcv7 Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File |
High EPSS 0.34% |
< 2.1.53 | 2.1.53 |
| GHSA-ff64-7w26-62rf Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json |
Critical EPSS 0.54% |
< 2.1.2 | 2.1.2 |
| GHSA-4q92-rfm6-2cqx Claude Code has Permission Deny Bypass Through Symbolic Links |
High EPSS 0.46% |
< 2.1.7 | 2.1.7 |
| GHSA-mhg7-666j-cqg4 Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions |
Medium EPSS 0.39% |
< 2.0.55 | 2.0.55 |
| GHSA-66q4-vfjg-2qhh Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection |
Critical EPSS 0.52% |
< 2.0.57 | 2.0.57 |
| GHSA-qgqw-h4xq-7w8w Claude Code has a Command Injection in find Command Bypasses User Approval Prompt |
High EPSS 0.64% |
< 2.0.72 | 2.0.72 |
| GHSA-q728-gf8j-w49r Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes |
Medium EPSS 0.51% |
< 2.0.74 | 2.0.74 |
| GHSA-vhw5-3g5m-8ggf Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains |
High EPSS 0.43% |
< 1.0.111 | 1.0.111 |
| GHSA-jh7p-qr78-84p7 Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation |
High EPSS 27.50% |
< 2.0.65 | 2.0.65 |
| GHSA-xq4m-mc3c-vvg3 Claude Code Command Validation Bypass Allows Arbitrary Code Execution |
Critical EPSS 0.69% |
< 1.0.93 | 1.0.93 |
| GHSA-7mv8-j34q-vp7q @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes |
Critical EPSS 0.62% |
< 2.0.31 | 2.0.31 |
| GHSA-5hhx-v7f6-x7gv Claude Code vulnerable to command execution prior to startup trust dialog |
Critical EPSS 0.55% |
< 1.0.39 | 1.0.39 |
| GHSA-66m2-gx93-v996 Claude Code permission deny bypass through symlink |
Medium EPSS 0.45% |
< 1.0.120 | 1.0.120 |
| GHSA-4fgq-fpq9-mr3g Claude Code can execute commands prior to the startup trust dialog |
High EPSS 24.89% |
< 1.0.111 | 1.0.111 |
| GHSA-2jjv-qf24-vfm4 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions |
Critical EPSS 0.36% |
< 1.0.39 | 1.0.39 |
| GHSA-j4h9-wv2m-wrf7 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email |
Critical EPSS 0.55% |
< 1.0.105 | 1.0.105 |
| GHSA-qxfv-fcpc-w36x Claude Code rg vulnerability does not protect against approval prompt bypass |
Critical EPSS 0.55% |
< 1.0.105 | 1.0.105 |
| GHSA-ph6w-f82w-28w6 Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning |
High | < 1.0.87 | 1.0.87 |
| GHSA-x5gv-jw7f-j6xj Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code |
High EPSS 0.60% |
< 1.0.4 | 1.0.4 |
| GHSA-x56v-x2h6-7j34 Claude Code echo command allowed bypass of user approval prompt for command execution |
Critical EPSS 1.04% |
< 1.0.20 | 1.0.20 |
| GHSA-pmw4-pwvc-3hx2 Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access |
Critical EPSS 1.39% |
< 0.2.111 | 0.2.111 |
| GHSA-9f65-56v6-gxw7 Claude Code Improper Authorization via websocket connections from arbitrary origins |
High EPSS 0.36% |
>= 0.2.116, < 1.0.24 | 1.0.24 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor