@anthropic-ai/claude-code 2.1.54

Direct Vulnerabilities

Known vulnerabilities in the @anthropic-ai/claude-code package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Symlink Attack @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Symlink Attack in the handling of worktrees when interacting with repositories containing specially crafted symbolic links and directory names. An attacker can execute arbitrary code outside of sandbox restrictions by convincing a user to clone a malicious repository and run the application against its contents. This can result in the overwriting of configuration files in the user's home directory, such as `.zshenv`, leading to unauthorized code execution. How to fix Symlink Attack? Upgrade `@anthropic-ai/claude-code` to version 2.1.163 or higher.	>=2.1.38 <2.1.163
M Covert Storage Channel @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Covert Storage Channel via the `WebFetch` tool. An attacker can access sensitive data by injecting untrusted content that triggers requests to attacker-controlled paths on a pre-approved domain, enabling covert exfiltration of files, environment variables, or command output. Note: This is only exploitable if an attacker can add untrusted content into the context window. How to fix Covert Storage Channel? Upgrade `@anthropic-ai/claude-code` to version 2.1.163 or higher.	>=0.2.54 <2.1.163
H UNIX Symbolic Link (Symlink) Following @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following. An attacker can cause arbitrary files to be written outside the intended workspace by leveraging symlink manipulation and prompt injection to execute code in a sandboxed context, which is then followed by an unsandboxed process writing to the symlink target. Note: This is only exploitable if an attacker can inject untrusted content into the context window to trigger sandboxed code execution via prompt injection. How to fix UNIX Symbolic Link (Symlink) Following? Upgrade `@anthropic-ai/claude-code` to version 2.1.64 or higher.	<2.1.64
H Reliance on Untrusted Inputs in a Security Decision @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Workspace Trust Dialog. An attacker can gain unauthorized tool execution by committing a `.claude/settings.json` file with `permissions.defaultMode` set to `bypassPermissions`, causing the workspace trust confirmation dialog to be skipped and placing the user in a permissive mode without their explicit consent. How to fix Reliance on Untrusted Inputs in a Security Decision? Upgrade `@anthropic-ai/claude-code` to version 2.1.80 or higher.	<2.1.80

Vulnerability

Vulnerable Version

Symlink Attack

@anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

Affected versions of this package are vulnerable to Symlink Attack in the handling of worktrees when interacting with repositories containing specially crafted symbolic links and directory names. An attacker can execute arbitrary code outside of sandbox restrictions by convincing a user to clone a malicious repository and run the application against its contents. This can result in the overwriting of configuration files in the user's home directory, such as .zshenv, leading to unauthorized code execution.

How to fix Symlink Attack?

Upgrade @anthropic-ai/claude-code to version 2.1.163 or higher.

>=2.1.38 <2.1.163

Covert Storage Channel

Affected versions of this package are vulnerable to Covert Storage Channel via the WebFetch tool. An attacker can access sensitive data by injecting untrusted content that triggers requests to attacker-controlled paths on a pre-approved domain, enabling covert exfiltration of files, environment variables, or command output.

Note: This is only exploitable if an attacker can add untrusted content into the context window.

How to fix Covert Storage Channel?

Upgrade @anthropic-ai/claude-code to version 2.1.163 or higher.

>=0.2.54 <2.1.163

UNIX Symbolic Link (Symlink) Following

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following. An attacker can cause arbitrary files to be written outside the intended workspace by leveraging symlink manipulation and prompt injection to execute code in a sandboxed context, which is then followed by an unsandboxed process writing to the symlink target.

Note:

This is only exploitable if an attacker can inject untrusted content into the context window to trigger sandboxed code execution via prompt injection.

How to fix UNIX Symbolic Link (Symlink) Following?

Upgrade @anthropic-ai/claude-code to version 2.1.64 or higher.

<2.1.64

Reliance on Untrusted Inputs in a Security Decision

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Workspace Trust Dialog. An attacker can gain unauthorized tool execution by committing a .claude/settings.json file with permissions.defaultMode set to bypassPermissions, causing the workspace trust confirmation dialog to be skipped and placing the user in a permissive mode without their explicit consent.

How to fix Reliance on Untrusted Inputs in a Security Decision?

Upgrade @anthropic-ai/claude-code to version 2.1.80 or higher.

<2.1.80

@anthropic-ai/claude-code@2.1.54

Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically