Vulnerability Intelligence Report
Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution
CVE-2025-58764
Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.51%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Threat Intelligence Signals
EPSS Score
0.512%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2025-09-04T19:18:09 |
| Published | 2025-09-10T15:06:30 |
| Last Updated | 2025-09-11T14:43:27 |
Community Chatter & Buzz