CVE-2025-64755

Executive Summary

CVE-2025-64755 is a critical security vulnerability in Anthropic's Claude Code, an agentic coding tool. Prior to version 2.0.31, a flaw in the sed command parsing logic allowed an attacker to bypass the read-only validation mechanism, enabling arbitrary file writes on the host system. This vulnerability could be exploited by a malicious actor to overwrite system files, inject malicious code, or compromise the integrity of the host environment. The issue has been patched in version 2.0.31.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects a standalone agentic coding tool. However, if Claude Code is distributed or updated via a package manager, supply chain security is a concern. Users should ensure they are obtaining the patched version (2.0.31) from official sources to avoid tampered builds.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – Requires local access to the system running Claude Code.
• Attack Complexity (AC): Low (L) – Exploitation is straightforward via crafted sed commands.
• Privileges Required (PR): Low (L) – Attacker needs user-level access to run Claude Code.
• User Interaction (UI): None (N) – No user interaction required beyond running the tool.
• Scope (S): Unchanged (U) – The vulnerability affects the host system, not a separate security scope.
• Confidentiality (C): High (H) – Arbitrary file writes can expose sensitive data.
• Integrity (I): High (H) – Files can be overwritten, compromising system integrity.
• Availability (A): High (H) – Critical system files could be corrupted, leading to denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Deep Dive & Mechanics

The vulnerability resides in how Claude Code parses sed commands. The tool likely uses sed for file manipulation but implements a read-only validation to prevent writes to arbitrary files. Due to an error in parsing, an attacker can craft a sed command that bypasses this validation.

Mechanism:

1. Claude Code receives a sed command from the user or an external source.
2. The tool attempts to validate that the target file is within a read-only scope (e.g., a sandboxed directory).
3. Due to improper parsing of sed arguments (e.g., using -i flag with a backup extension or path traversal), the validation fails.
4. The sed command executes with the attacker's intended file path, allowing writes to arbitrary locations.

Example Attack Vector:

• A malicious actor could issue a sed command like: sed -i 's/old/new/' /etc/passwd or use path traversal: sed -i 's/old/new/' ../../etc/shadow.
• The validation logic might only check for absolute paths or specific patterns, but fails to account for relative paths or symbolic links.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.0.31):

# Simplified vulnerable validation logic
def validate_file_path(file_path):
    allowed_prefix = "/safe/directory/"
    if file_path.startswith(allowed_prefix):
        return True
    return False

# Attacker bypasses with relative path
# sed -i 's/old/new/' ../../../etc/passwd

Patched Code (2.0.31):

# Patched validation logic
import os

def validate_file_path(file_path):
    allowed_prefix = "/safe/directory/"
    # Resolve the absolute path to prevent path traversal
    resolved_path = os.path.realpath(file_path)
    if resolved_path.startswith(allowed_prefix):
        return True
    return False

The patch uses os.path.realpath() to resolve symbolic links and relative paths before validation, preventing bypasses.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Local access to a system running Claude Code < 2.0.31.
• Ability to execute sed commands through the tool.

Exploitation Steps:

1. Identify a target file to overwrite (e.g., /etc/cron.d/malicious).
2. Craft a sed command that bypasses the read-only validation:

   sed -i 's/.*/malicious_command/' /etc/cron.d/malicious
   

3. Use path traversal if the validation checks for absolute paths:

   sed -i 's/.*/malicious_command/' ../../../../etc/cron.d/malicious
   

4. Execute the command through Claude Code.

Expected Outcome: Arbitrary file write, potentially leading to code execution or privilege escalation.

Blue Team (Defender)

Detection:

• Monitor for unusual sed commands executed by Claude Code.
• Look for file writes outside of expected directories (e.g., /etc, /usr/bin).
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Mitigation:

• Immediately update Claude Code to version 2.0.31 or later.
• Restrict user permissions to prevent access to critical system files.
• Implement application whitelisting to block unauthorized tools.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /etc/cron.d/*, /usr/bin/*
• Commands: sed -i with paths outside of /safe/directory/
• Logs: Unusual sed invocations in system logs (e.g., /var/log/syslog)
• Network: No network IOCs as this is a local vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_64755_Claude_Code_Sed_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-64755 via sed command bypass"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64755"
    strings:
        $sed_cmd = /sed\s+-i\s+.*\/etc\// nocase
        $sed_traversal = /sed\s+-i\s+.*\.\.\// nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-64755 Claude Code Sed Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects sed commands targeting sensitive files, indicating exploitation of CVE-2025-64755
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sed'
        CommandLine|contains:
            - '/etc/'
            - '../'
    condition: selection
falsepositives:
    - Legitimate system administration tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64755 Claude Code Sed Bypass"; flow:to_server,established; content:"sed -i"; http_uri; content:"/etc/"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update Claude Code to version 2.0.31 or later.
2. Workaround: If unable to update, restrict the tool's file system access using AppArmor or SELinux policies.
3. Monitoring: Enable logging of all sed commands and monitor for suspicious activity.
4. User Training: Educate users on the risks of executing untrusted commands through agentic tools.
5. Patch Verification: Verify the integrity of the patched binary using checksums provided by Anthropic.

Valters IT
Securing Digital Frontiers