Claude Code versions before 2.0.57 allow a change of directory without adequate validation when combined with write operations to protected folders. By inserting the cd command into the context window, a user who can supply untrusted content can navigate into sensitive directories such as .claude and then create or modify files without user confirmation. The flaw therefore permits unauthorized file manipulation, code injection and potentially persistent compromise, and is classified as improper input validation (CWE‑20) and OS command injection (CWE‑78).

Vendor: Anthropic; Product: Claude Code; All releases before version 2.0.57 are affected. The vulnerability was fixed in v2.0.57 and later releases are considered safe.

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1 % points to a low likelihood of exploitation at present. The flaw requires that an attacker be able to inject untrusted content into the context window, limiting the attack surface to environments that allow such content. It is not currently listed in the CISA KEV catalog. Because the vulnerability permits modification of protected files, an exploit could lead to persistence if the altered files are executed. The overall risk balances significant impact with a low probability of exploitation, and the most effective mitigation is to patch.