Anthropic vulnerabilities
We track 6 vulnerabilities in Anthropic products across 7 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Anthropic vulnerabilities
- 7.7 High severity
@anthropic-ai/claude-code: Improper Limitation of a Pathname to a Restricted Directory
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker wh
- 8.7 High severity
Claude Desktop Cowork: Missing Support for Integrity Check
Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image conten
- 7.8 High severity
claude-code: Improper Link Resolution Before File Access
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle di
- 7.8 High severity
Claude Desktop - Windows: Uncontrolled Search Path Element
Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after
- 7.5 High severity
MCP TypeScript SDK: Inefficient Regular Expression Complexity
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used
- 9.3 Critical severity
A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context…
A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containi