CVE-2025-64755

Critical

Published: 21/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Claude Code, an agentic coding tool, prior to version 2.0.31 has an error in sed command parsing that allows bypassing the read-only validation and writing to arbitrary files on the host system.

Risk Assessment

The risk includes the ability to modify critical system files, potentially leading to system integrity compromise or privilege escalation.

Recommendation

Update Claude Code to version 2.0.31 or later and monitor the tool's activities in production environments.

Original NVD description (English source)

Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.