An Evening with Claude (Code)

**Executive summary:** A researcher from SpecterOps discovered a command-injection and local remote code execution (RCE) vulnerability in Claude Code (assigned CVE-2025-64755) where insufficient validation of shell command patterns—specifically sed expression handling—allowed writing to arbitrary files and achieving code execution; the issue was disclosed to Anthropic and fixed in Claude Code v2.0.31.