Command Parsing Vulnerability in Claude Code by Anthropic
CVE-2026-24887

7.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24887?

Claude Code, an agentic coding tool by Anthropic, contains a command parsing flaw that allows attackers to bypass confirmation prompts, enabling the execution of untrusted commands. This vulnerability arises when an attacker is able to inject untrusted content into a Claude Code context window. The issue has been addressed in version 2.0.72, highlighting the importance of keeping software updated to mitigate potential security threats.

Affected Version(s)

claude-code < 2.0.72

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.