Claude Code before 2.1.325 has several security fixes: a zstd response decoding issue, Bash commands that could run without a permission prompt, and gaps in the Bash sandbox (Anthropic fixed in 2.1.325, no CVE)

Anthropic released Claude Code 2.1.325 on 13 Nov 2026. The release notes list 'a security issue in how zstd-compressed responses are decoded' with no further detail. The same release fixes: some compound Bash commands running without asking for permission; a Bash allow rule that could run a different program than the one it names; some deny and ask rules not applying to certain Bash commands; relative deny rules (e.g. Read(./.env)) no longer covering the project after a cd; deny rules not applied to approvals that arrive after a restart in self-hosted runner and 'claude remote-control' sessions; the Bash sandbox not fully protecting a worktree's settings and hooks or a linked worktree's shared git folder; sandboxed commands able to write to the native updater's download folder; a committed .claude/settings.local.json being treated as the user's own in some subfolders; and Bedrock token counting sending the conversation to Bedrock when allowedProviders does not allow it. Whether any of these were exploited is unknown; no CVE or advisory yet. This is separate from the 2.1.321 fixes (TECH-202611-ackg3u).