Claude Code + SDKs
Filed as: Claude Code, Claude SDK for Python, Claude SDK for TypeScript, Anthropic bots, Claude Agent SDK, Claude Code Action
Newest record 2026-11-12 · 46 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Exploited or KEV-listed · 4
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
- closedOpenAI bots Attacker Scans for Credentials by Impersonating AI Bots
Exploited · since 28 Oct 2026
AI - closedClaude Code + SDKs Threat Actor Used AI Agents to Breach Healthcare Organizations in Argentina
Exploited · since 19 May 2026
AI - closedClaude Anthropic Identifies AI Misuse in Extortion and Ransomware Campaigns
Exploited · since 27 Aug 2025
AI - closedClaude Code + SDKs Malicious Nx npm Packages Weaponize AI Coding Agents for Exfiltration
Exploited · since 21 Aug 2025
AI
Disclosures by month · last 24 months
Disclosed CVEs, no confirmed exploitation · 47
- closed7.7Claude Code + SDKs CVE-2026-88968: Path traversal flaw in Claude Code allows arbitrary file overwrite
Disclosed · Patched · since 3 Nov 2026 · updated 9 Nov 2026 · CVE-2026-88968
AI - closed9.2Claude Code + SDKs CVE-2026-96620: Claude Agent SDK Command Injection Vulnerability
Disclosed · since 16 Oct 2026 · CVE-2026-96620
AI - closed7.5Claude Code + SDKs CVE-2026-86063: Claude Code plugin installation flow hash pin bypass vulnerability
Disclosed · since 13 Oct 2026 · updated 15 Oct 2026 · CVE-2026-86063
AI - closed7.7Claude Code + SDKs CVE-2026-103435: Time-of-check to time-of-use vulnerability in Claude Code sandbox
Disclosed · since 7 Oct 2026 · CVE-2026-103435
AI - closed2.0Claude Code + SDKs CVE-2026-103012: Claude Code API Key Precedence Policy Bypass
Disclosed · since 30 Sep 2026 · CVE-2026-103012
AI - closed8.6OpenClaw CVE-2026-100585: OpenClaw bypasses owner-only authorization for Claude Code prompts
Disclosed · since 26 Sep 2026 · CVE-2026-100585
AI - closed7.1neuro-cortex-memory CVE-2026-49986: Cortex MCP Server vulnerability allows improper developer root validation
Disclosed · since 14 Aug 2026 · CVE-2026-49986
AI - closed8.8ClaudeHookBridge CVE-2026-73614: ClaudeHookBridge deny pattern bypass vulnerability
Disclosed · since 13 Aug 2026 · CVE-2026-73614
AI - closed5.3Claude Code + SDKs CVE-2026-47751: Claude Code Action vulnerable to malicious MCP configuration
Disclosed · since 16 Jul 2026 · CVE-2026-47751
AI - closed10.0Ruflo Unauthenticated MCP Bridge Endpoint Exposure in Ruflo
Disclosed · since 9 Jul 2026 · CVE-2026-59726
AI - closed7.7Claude Code + SDKs CVE-2026-55607: Claude Code sandbox escape via git worktree path confusion
Disclosed · since 24 Jul 2026 · updated 24 Jul 2026 · CVE-2026-55607
AI - closed4.4Claude Code + SDKs CVE-2026-46406: Anthropic Claude Code Insecure Temporary File Handling in Copy Command
Disclosed · since 25 Jun 2026 · updated 29 Jun 2026 · CVE-2026-46406
AI - closed9.1Claude Code + SDKs CVE-2026-54316: Claude Code Out-of-Band Data Exfiltration via WebFetch
Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54316
AI - closed8.6claude-code-cache-fix CVE-2026-45136: Remote code execution in claude-code-cache-fix
Disclosed · since 27 May 2026 · CVE-2026-45136
AI - closed7.4Claude Desktop CVE-2026-44467: Claude Desktop SSH Remote Development Verification Flaw
Disclosed · since 13 May 2026 · CVE-2026-44467
AI - closed8.5Claude Desktop CVE-2026-44470: Claude Desktop CoworkVMService File Creation Vulnerability
Disclosed · since 13 May 2026 · CVE-2026-44470
AI - closed4.8Claude Code + SDKs CVE-2026-41686: Claude SDK TypeScript Insecure File Permissions
Disclosed · since 29 Apr 2026 · CVE-2026-41686
AI - closed7.7Claude Code + SDKs CVE-2026-40068: Claude Code Trust Dialog Bypass via Git Worktree
Disclosed · since 24 Apr 2026 · updated 5 May 2026 · CVE-2026-40068
AI - closed10.0Claude Code + SDKs CVE-2026-39861: Claude Code Sandbox Escape via Symlink
Disclosed · since 21 Apr 2026 · CVE-2026-39861
AI - closed7.3Claude Code + SDKs CVE-2026-35603: Claude Code Insecure Configuration Loading LPE
Disclosed · since 17 Apr 2026 · CVE-2026-35603
AI - closed5.8Claude Code + SDKs CVE-2026-34452: Anthropic Claude Python SDK Sandbox Escape
Disclosed · since 1 Apr 2026 · CVE-2026-34452
AI - closed6.3Claude Code + SDKs CVE-2026-34451: Claude TypeScript SDK Memory Tool Sandbox Escape
Disclosed · since 1 Apr 2026 · CVE-2026-34451
AI - closed4.8Claude Code + SDKs CVE-2026-34450: Claude Python SDK Insecure File Permissions
Disclosed · since 1 Apr 2026 · CVE-2026-34450
AI - closed7.7Claude Code + SDKs Claude Code workspace trust dialog bypass via settings file
Disclosed · since 19 Mar 2026 · updated 20 Mar 2026 · CVE-2026-33068
AI - closed9.1Claude Code UI CVE-2026-31862: RCE vulnerability in Cloud CLI Claude Code UI
Disclosed · since 11 Mar 2026 · CVE-2026-31862
AI - closed7.7Claude Code + SDKs CVE-2026-25722: Claude Code Directory Change Write Protection Bypass
Disclosed · since 6 Feb 2026 · CVE-2026-25722
AI - closed7.7Claude Code + SDKs CVE-2026-25723: Claude Code Command Injection Bypass
Disclosed · since 6 Feb 2026 · CVE-2026-25723
AI - closed7.7Claude Code + SDKs CVE-2026-25725: Claude Code Sandbox Escape via Settings Injection
Disclosed · since 6 Feb 2026 · CVE-2026-25725
AI - closed2.3Claude Code + SDKs CVE-2026-25724: Claude Code Permission Deny Bypass
Disclosed · since 6 Feb 2026 · CVE-2026-25724
AI - closed7.7Claude Code + SDKs CVE-2026-24887: Claude Code command injection in find command bypasses prompts
Disclosed · since 3 Feb 2026 · CVE-2026-24887
AI - closed7.7Claude Code + SDKs CVE-2026-24053: Claude Code path restriction bypass via ZSH clobber
Disclosed · since 3 Feb 2026 · CVE-2026-24053
AI - closed7.1Claude Code + SDKs CVE-2026-24052: Claude Code domain validation bypass enables arbitrary requests
Disclosed · since 3 Feb 2026 · CVE-2026-24052
AI - closed5.3Claude Code + SDKs CVE-2026-21852: Claude Code Data Leak via Malicious Config
Disclosed · since 21 Jan 2026 · CVE-2026-21852
AI - closed8.7Claude Code + SDKs CVE-2025-66032: Claude Code Command Validation Bypass
Disclosed · since 3 Dec 2025 · CVE-2025-66032
AI - closed8.7Claude Code + SDKs CVE-2025-64755: Anthropic Claude Code Sed Command Validation Bypass
Disclosed · since 20 Nov 2025 · updated 21 Nov 2025 · CVE-2025-64755
AI - closed7.7Claude Code + SDKs CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog
Disclosed · since 19 Nov 2025 · CVE-2025-65099
AI - closed2.3Claude Code + SDKs CVE-2025-59829: Claude Code symlink permission bypass vulnerability
Disclosed · since 3 Oct 2025 · CVE-2025-59829
AI - closed8.7Claude Code + SDKs CVE-2025-59536: Claude Code startup trust dialog code injection vulnerability
Disclosed · since 3 Oct 2025 · CVE-2025-59536
AI - closed6.5AgentAPI CVE-2025-59956: AgentAPI Client-Side DNS Rebinding Data Exfiltration Flaw
Disclosed · since 30 Sep 2025 · CVE-2025-59956
AI - closed7.7Claude Code + SDKs CVE-2025-59828: Claude Code vulnerable to arbitrary code execution via Yarn
Disclosed · since 24 Sep 2025 · CVE-2025-59828
AI - closed8.7Claude Code + SDKs CVE-2025-58764: Claude Code command parsing bypasses confirmation prompt
Disclosed · since 10 Sep 2025 · CVE-2025-58764
AI - closed8.5Claude Code + SDKs CVE-2025-59041: Claude Code arbitrary code execution via git config email
Disclosed · since 10 Sep 2025 · CVE-2025-59041
AI - closedClaude Code + SDKs Claude Code Arbitrary Code Execution via Insufficient Startup Warning
Disclosed · since 3 Sep 2025
AI - closed7.1Claude Code + SDKs CVE-2025-55284: Claude Code Allowlist Bypass Enables Unauthorized File Read
Disclosed · since 18 Aug 2025 · updated 18 Aug 2025 · CVE-2025-55284
AI - closed8.7Claude Code + SDKs CVE-2025-54795: Claude Code Command Prompt Execution Bypass
Disclosed · since 4 Aug 2025 · updated 5 Aug 2025 · CVE-2025-54795
AI - closed7.7Claude Code + SDKs CVE-2025-54794: Claude Code Path Restriction Bypass Vulnerability
Disclosed · since 4 Aug 2025 · updated 5 Aug 2025 · CVE-2025-54794
AI - closed8.8Claude Code + SDKs CVE-2025-52882: Claude Code improper authorization via websocket connections
Disclosed · since 23 Jun 2025 · updated 24 Jun 2025 · CVE-2025-52882
AI
Other incidents: research and unexploited reports · 3
- liveClaude Code + SDKs Stolen Claude API keys turn Claude Code into a remote implant
Research · since 12 Nov 2026
AI - liveClaude Code + SDKs Claude Code Inadvertently Leaks Credentials to Public Repositories
Research · since 10 Nov 2026
AI - closedClaude Code + SDKs Security Impact of Coding Agent's Memory Files
Research · since 30 Oct 2026
AI
Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.