Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 15.10.2026

CVE-2026-86063

Claude Code: La omisión del anclaje de hash del complemento permite eludir el hash pinning

Una vulnerabilidad en Claude Code permitía eludir la verificación de hash fijado durante la instalación de complementos mediante ramas de Git especialmente nombradas, instalando código no confiable. Se recomienda actualizar a la última versión.

npm

@anthropic-ai/claude-code

Alta 24.07.2026

CVE-2026-55607

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

npm

@anthropic-ai/claude-code

Media 25.06.2026

CVE-2026-46406

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

npm

@anthropic-ai/claude-code

Media 17.06.2026

CVE-2026-54316

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

npm

@anthropic-ai/claude-code

Alta 24.04.2026

CVE-2026-40068

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Alta 21.04.2026

CVE-2026-39861

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

npm

@anthropic-ai/claude-code

Media 17.04.2026

CVE-2026-35603

Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

npm

@anthropic-ai/claude-code

Alta 19.03.2026

CVE-2026-33068

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

npm

@anthropic-ai/claude-code

Alta 06.02.2026

CVE-2026-25725

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

npm

@anthropic-ai/claude-code

Baja 06.02.2026

CVE-2026-25724

Claude Code has Permission Deny Bypass Through Symbolic Links

npm

@anthropic-ai/claude-code

Alta 06.02.2026

CVE-2026-25723

Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

npm

@anthropic-ai/claude-code

Alta 06.02.2026

CVE-2026-25722

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

npm

@anthropic-ai/claude-code

Alta 03.02.2026

CVE-2026-24887

Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

npm

@anthropic-ai/claude-code

Alta 03.02.2026

CVE-2026-24053

Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Alta 03.02.2026

CVE-2026-24052

Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

npm

@anthropic-ai/claude-code

Media 21.01.2026

CVE-2026-21852

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

npm

@anthropic-ai/claude-code

Alta 03.12.2025

CVE-2025-66032

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

npm

@anthropic-ai/claude-code

Alta 20.11.2025

CVE-2025-64755

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

npm

@anthropic-ai/claude-code

Alta 19.11.2025

CVE-2025-65099

Claude Code vulnerable to command execution prior to startup trust dialog

npm

@anthropic-ai/claude-code

Baja 03.10.2025

CVE-2025-59829

Claude Code permission deny bypass through symlink

npm

@anthropic-ai/claude-code

Alta 03.10.2025

CVE-2025-59536

Claude Code can execute commands prior to the startup trust dialog

npm

@anthropic-ai/claude-code

Alta 24.09.2025

CVE-2025-59828

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

npm

@anthropic-ai/claude-code

Alta 10.09.2025

CVE-2025-59041

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

npm

@anthropic-ai/claude-code

Alta 10.09.2025

CVE-2025-58764

Claude Code rg vulnerability does not protect against approval prompt bypass

npm

@anthropic-ai/claude-code