Bash Command Validation Flaw in Claude Code by Anthropics
CVE-2026-24053

7.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24053?

The vulnerability in Claude Code, a coding tool developed by Anthropics, stems from a flaw in Bash command validation when parsing ZSH clobber syntax. This weakness enables attackers to bypass directory restrictions, allowing unauthorized file writes outside of the current working directory without prompting users for permission. This exploit requires the use of ZSH and the capability to introduce untrusted content into the coding environment of Claude Code. Users are encouraged to update to version 2.0.74, where this issue has been addressed, to ensure the integrity and security of their coding environment.

Affected Version(s)

claude-code < 2.0.74

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.