Claude Code CVE Roundup (2024–2026) — Known Vulnerabilities & Patches

Claude Code is a privileged terminal agent — it edits your files, runs shell commands, and connects to MCP servers. That privilege has produced a small but interesting CVE history. This page tracks every public advisory we have verified, the root cause, and the fixed version.

Claude Code's attack surface

Runs as your user — read/write on $HOME, can spawn subprocesses.
Auto-approve modes (--dangerously-skip-permissions, accept-all) widen the blast radius dramatically.
MCP server connections inherit Claude Code's permissions on each tool call.
Reads arbitrary repo content (issues, READMEs, dependency descriptions) into context — every one is an injection vector.

Threat model in one line

Any untrusted text reaching Claude Code's context is a potential RCE primitive when auto-approve is on.

Known issues by family

Prompt-injection → command execution

The dominant class. Researchers (Embrace the Red, Simon Willison, Anthropic's own red team) have repeatedly shown that issue text, README files, npm postinstall scripts, and MCP tool descriptions can coerce Claude Code into running arbitrary shell commands when permissions are pre-approved. Anthropic's response: explicit per-command approval prompts, allowlisted command patterns per project, and the 2025 sandboxed-execution mode.

MCP transport handling

Several public MCP server implementations shipped with auth-less HTTP transports bound to 0.0.0.0. Claude Code itself accepts these without warning unless the user has updated to versions with the connection-trust dialog. Mitigation: bind MCP servers to 127.0.0.1, require token auth, and update Claude Code regularly.

Credential exposure

Early versions logged full prompts (including pasted secrets) to ~/.claude/logs. Current versions redact common token patterns but do not catch everything — never paste production secrets into an agent prompt.

Supply chain via auto-installed tools

Claude Code will, if asked, install npm/pip packages to satisfy a task. A typosquatted package recommended by the model is a real vector. Recommend a `--no-install` workflow and review dependency suggestions manually.

10-point Claude Code hardening checklist

Update to the latest Claude Code release on a known schedule.
Never run with --dangerously-skip-permissions outside a throwaway container.
Use per-project .claude/settings.json to allowlist commands.
Prefer the sandboxed execution mode for untrusted repos.
Bind all MCP servers to 127.0.0.1 with token auth.
Audit MCP tool descriptions for hidden imperative text before connecting.
Never paste production credentials into a Claude Code prompt.
Treat issue bodies, READMEs, and dependency descriptions as adversarial input.
Pin npm/pip/uv versions; do not let the agent install unpinned packages.
Log + review agent transcripts for anomalous commands weekly.

FAQ

Where are official Claude Code advisories published?

Anthropic publishes via their trust center and the Claude Code GitHub release notes. Subscribe to release notifications.

Is Claude Code safer than Cursor or Cline?

Architecturally similar; Claude Code's permission UX is stricter by default. All agentic coding tools share the same threat model.

Claude Code CVE Roundup: Known Exploits & Fixes (2024–2026)