CVE-2025-58764

Executive Summary

CVE-2025-58764 is a command injection vulnerability in Anthropic's Claude Code, an agentic coding tool. The flaw resides in the command parsing logic of versions prior to 1.0.105, allowing an attacker to bypass the confirmation prompt and execute untrusted commands. Successful exploitation requires the ability to inject untrusted content into the Claude Code context window, which could occur through malicious code repositories, compromised dependencies, or crafted prompts. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the EPSS score is 0.0%, indicating low exploitation probability at this time. No public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

Claude Code is distributed via standard auto-update mechanisms and manual updates. The vulnerability does not directly affect open-source packages (NPM, PyPI, Go, Ruby) but is a client-side tool that interacts with code repositories. The risk is amplified in supply chain scenarios where an attacker could inject malicious content into a repository that a developer then loads into Claude Code, triggering the command injection without user confirmation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS vector would be:

• Attack Vector (AV): Network (if context window is fed remotely)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None (attacker only needs to inject content)
• User Interaction (UI): Required (user must load content into Claude Code)
• Scope (S): Unchanged
• Confidentiality (C): High (potential data exfiltration)
• Integrity (I): High (arbitrary command execution)
• Availability (A): High (could disrupt system)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Score: 8.8 - High)

Threat Level: High. Although no public exploit exists, the ability to bypass confirmation prompts in an agentic coding tool poses significant risk to development environments.

Deep Dive & Mechanics

The vulnerability is rooted in an error in command parsing within Claude Code. The tool is designed to execute commands on behalf of the user, but it should prompt for confirmation before running untrusted commands. Due to the parsing flaw, certain crafted inputs can bypass this confirmation prompt, leading to automatic execution.

Attack Vector: An attacker must inject untrusted content into the Claude Code context window. This could be achieved by:

• Providing a malicious code repository (e.g., via a pull request or cloned repo).
• Embedding malicious instructions in a file that Claude Code processes.
• Crafting a prompt that exploits the parsing error.

Mechanism: The parsing logic fails to properly validate or sanitize command boundaries, allowing an attacker to embed a command that is interpreted as a trusted action, thus skipping the confirmation dialog.

Impact: Arbitrary command execution with the privileges of the Claude Code process, potentially leading to data theft, system compromise, or lateral movement within the development environment.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.0.105): The vulnerable code likely had a flaw in the command parser that did not correctly handle certain escape sequences or delimiters. For example, a command like ls; malicious_command might have been parsed as a single trusted command.

# Hypothetical vulnerable parsing logic
def parse_command(input_string):
    # Flawed: does not properly handle semicolons or newlines
    if input_string.startswith("safe_command"):
        return execute(input_string)
    else:
        return prompt_user(input_string)

Patched Code (1.0.105): The patch likely introduces stricter parsing that validates the entire command string before execution, ensuring that only explicitly trusted commands are executed without confirmation.

# Hypothetical patched parsing logic
def parse_command(input_string):
    # Properly sanitize and validate
    sanitized = sanitize_input(input_string)
    if is_trusted_command(sanitized):
        return execute(sanitized)
    else:
        return prompt_user(sanitized)

Key Difference: The patched version ensures that any deviation from a trusted command pattern triggers the confirmation prompt, preventing bypass.

Exploitation & Lab Setup

Red Team (Exploitation):

Since no public exploit code is available, a red team would need to craft a payload that exploits the parsing error. The goal is to inject a command that bypasses the confirmation prompt.

1. Setup: Install Claude Code version < 1.0.105 in a controlled environment.
2. Payload Crafting: Create a file or prompt containing a command that exploits the parsing flaw. For example, using a newline or special character to separate a trusted command from a malicious one.
3. Execution: Load the malicious content into Claude Code's context window. If the parsing flaw is triggered, the malicious command executes without user confirmation.

Example Payload (Hypothetical):

# In a file loaded into Claude Code
safe_command
malicious_command

Blue Team (Defense):

1. Detection: Monitor for unusual command execution patterns from Claude Code processes.
2. Prevention: Update to version 1.0.105 or later immediately.
3. Mitigation: Restrict Claude Code's permissions to limit the impact of any command execution.
4. Hunting: Search for logs indicating unexpected command execution without user interaction.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network Indicators: Unusual outbound connections from Claude Code process (e.g., to attacker-controlled servers).
• Process Indicators: Claude Code process executing commands that were not preceded by a confirmation prompt.
• Log Entries: Logs showing command execution without corresponding user approval events.

Detection Engineering

YARA Rule

rule CVE_2025_58764_Claude_Code_Command_Injection {
    meta:
        description = "Detects potential exploitation of CVE-2025-58764 in Claude Code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58764"
    strings:
        $cmd1 = "safe_command" ascii wide nocase
        $cmd2 = "malicious_command" ascii wide nocase
        $pattern = /safe_command[\r\n]+[a-zA-Z0-9_]+/ ascii
    condition:
        $pattern or ($cmd1 and $cmd2)
}

Sigma Rule

title: CVE-2025-58764 Claude Code Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-58764 in Claude Code
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58764
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\claude_code.exe'
        CommandLine|contains: 'safe_command'
    condition: selection
falsepositives:
    - Legitimate use of safe commands
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58764 Claude Code Command Injection"; flow:to_server,established; content:"safe_command"; nocase; content:"malicious_command"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade Claude Code to version 1.0.105 or later. Users on auto-update are already protected.
2. Manual Update: If using manual updates, download the latest version from the official Anthropic source.
3. Access Control: Limit the permissions of Claude Code to only necessary directories and commands.
4. Input Validation: Implement additional input validation on any content fed into Claude Code, especially from untrusted sources.
5. Monitoring: Enable logging and monitoring for Claude Code processes to detect anomalous command execution.
6. User Training: Educate users about the risks of loading untrusted content into agentic coding tools.

Valters IT