{"uuid": "08e3eeda-8ae8-4355-b249-11e3aceed04d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54795", "type": "seen", "source": "https://t.me/pphm_HackerNews/762", "content": "AI Coding Assistant Exploited to Breach Developer Systems\n\nClaude Code, Anthropic\u2019s AI-assisted coding plugin for IDEs like VS Code and JetBrains, originally isolated operations within a prescribed working directory (CWD) and limited execution to whitelisted commands such as ls, cat, and echo. A researcher uncovered two severe flaws in this sandbox model: CVE-2025-54794, a path prefix bug, and CVE-2025-54795, a command-injection flaw. Unexpectedly, the AI itself helped the attacker craft exploit payloads\u2014demonstrating how LLM-powered developer tools can undermine their own security boundaries.\n\n\ud83d\udd17 Read More", "creation_timestamp": "2026-07-22T05:00:05.504766Z"}