anthropics claude-code vulnerabilities

CVEs per yearBy the year they were published

1. 202512
2. 202620

Newest CVEs

• CVE-2026-88968

  Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

  anthropics · claude-code

  High7.7
• CVE-2026-88066

  Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable

  anthropics · claude-code

  High7.5
• CVE-2026-86063

  Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

  anthropics · claude-code

  High7.5
• CVE-2026-55607

  Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

  anthropics · claude-code

  High7.7
• CVE-2026-46406

  Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write

  anthropics · claude-code

  Medium4.4
• CVE-2026-54316

  Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

  anthropics · claude-code

  Medium6.0
• CVE-2026-44470

  Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService

  anthropics · claude-code

  High8.5
• CVE-2026-44467

  Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

  anthropics · claude-code

  High7.4
• CVE-2026-40068

  Claude Code arbitrary code execution via git worktree commondir trust dialog bypass

  anthropics · claude-code

  High7.7
• CVE-2026-39861

  Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

  anthropics · claude-code

  High7.7