Claude Code, an agentic coding tool, contains a command injection flaw that fails to validate piped sed commands combined with an echo statement. Attackers who can trigger the tool's "accept edits" capability can inject arbitrary shell commands, enabling them to write malicious content to restricted directories such as the .claude folder or to paths outside the defined project scope. The flaw directly compromises data integrity and could be used to deploy further code, leading to a high impact on confidentiality and integrity in the host environment.

Anthropics' Claude Code versions earlier than 2.0.55, including deployments running on Node.js environments, are vulnerable. The issue affects all installations where the "accept edits" feature is enabled and the tool is exposed to potentially untrusted input streams.

CVSS score 7.7 indicates high severity, while the EPSS score of less than 1% suggests limited exploitation probability currently. The vulnerability is not present in CISA's KEV catalog. Exploitation requires that the attacker can supply input to Claude Code's accept edits function, which in typical deployments is limited to authenticated users. Nevertheless, once the condition is met, the attacker can bypass file write restrictions and place arbitrary files, which could be leveraged for further attacks.