---
id: "TECH-202611-vz46rd"
page: "https://infrastack.ai/live/TECH-202611-vz46rd"
kind: "technique"
aliases: []
title: "Claude Code before 2.1.325 has several security fixes: a zstd response decoding issue, Bash commands that could run without a permission prompt, and gaps in the Bash sandbox (Anthropic fixed in 2.1.325, no CVE)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Code", "fixed": [], "vendor": "Anthropic", "package": "@anthropic-ai/claude-code", "fixed_in": "2.1.325", "ecosystem": "npm"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-13T21:20:05+00:00"
updated_at: "2026-11-13T21:21:37+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-13T21:20:05+00:00"}]
exploit_sources: []
---

# Claude Code before 2.1.325 has several security fixes: a zstd response decoding issue, Bash commands that could run without a permission prompt, and gaps in the Bash sandbox (Anthropic fixed in 2.1.325, no CVE)

Link for people: https://infrastack.ai/live/TECH-202611-vz46rd (this .md is for agents)

Anthropic released Claude Code 2.1.325 on 13 Nov 2026. The release notes list 'a security issue in how zstd-compressed responses are decoded' with no further detail. The same release fixes: some compound Bash commands running without asking for permission; a Bash allow rule that could run a different program than the one it names; some deny and ask rules not applying to certain Bash commands; relative deny rules (e.g. Read(./.env)) no longer covering the project after a cd; deny rules not applied to approvals that arrive after a restart in self-hosted runner and 'claude remote-control' sessions; the Bash sandbox not fully protecting a worktree's settings and hooks or a linked worktree's shared git folder; sandboxed commands able to write to the native updater's download folder; a committed .claude/settings.local.json being treated as the user's own in some subfolders; and Bedrock token counting sending the conversation to Bedrock when allowedProviders does not allow it. Whether any of these were exploited is unknown; no CVE or advisory yet. This is separate from the 2.1.321 fixes (TECH-202611-ackg3u).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:Claude Code affected range not listed fixed no fixed version listed

## How to check

Run 'claude --version' (or check the @anthropic-ai/claude-code npm package version): anything below 2.1.325 lacks these fixes. Look at .claude/settings.local.json files committed to repos, and at Bash allow rules and deny rules (Read(./.env)-style) that you rely on to block commands or files. Exploit details and indicators: unknown.

## Fix

Update Claude Code to 2.1.325 or later (claude update, or npm i -g @anthropic-ai/claude-code@latest) on developer machines, CI and self-hosted runners. Until updated, do not rely on Bash allow/deny rules or the Bash sandbox alone to stop untrusted repos or prompt-injected commands, and do not commit .claude/settings.local.json.

## Timeline

- 2026-11-13T21:20:05+00:00 analyst

## Documents

- [describes] Claude Code releases: v2.1.325 https://github.com/anthropics/claude-code/releases/tag/v2.1.325

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_