Claude Code Directory Change Vulnerability Bypasses Write Protection

A vulnerability in Claude Code prior to version 2.0.57 allows users to bypass write protection in sensitive directories, such as .claude. This issue arises because the tool fails to properly validate directory changes when write operations are involved. Exploitation requires the ability to introduce untrusted content into a Claude Code context window.

Impact

Exploitation of this vulnerability could lead to unauthorized creation or modification of files in protected directories, without user confirmation.

Remediation

Users on standard Claude Code auto-update received this fix automatically. Users performing manual updates are advised to update to the latest version.