https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T00:23:02.993090+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-30384 cnvd-2025-30384 2026-10-10T00:23:03.054605+00:00 cnvd-2025-30384 https://cve.radiocsirt.org/vuln/euvd-2026-262454 EUVD-2026-262454 2026-10-10T00:23:03.054649+00:00 EUVD-2026-262454 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66032 fkie_cve-2025-66032 2026-10-10T00:23:03.054664+00:00

Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.

 https://cve.radiocsirt.org/vuln/ghsa-xq4m-mc3c-vvg3 GHSA-xq4m-mc3c-vvg3 — Claude Code Command Validation Bypass Allows Arbitrary Code Execution 2026-10-10T00:23:03.054697+00:00

Affected: npm: @anthropic-ai/claude-code

Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to [RyotaK](hxxps://ryotak.net) from [GMO Flatt Security Inc.](hxxps://flatt.tech/en/) for reporting this issue!