Back to Database
Status published
High
CVE-2025-54795
Claude Code echo command allowed bypass of user approval prompt for command execution
Vulnerability Description
Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This is fixed in version 1.0.20.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54795
Credits & Attribution
No credits recorded in the NVD database.
More from anthropics
View All →CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
High
8.7
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog
High
7.7
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
High
8.7
CVE-2025-59829
Claude Code: Permission deny bypass is possible through symlink
Low
2.3
CVE-2025-59828
Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions
High
7.7
Affected Vendor
anthropics
View all reports →Affected Software
claude-code
Vulnerable Versions:
< 1.0.20
Timeline
Official Publish:
August 5th, 2025
Last Modified:
August 5th, 2025
Added to House:
July 22nd, 2026