Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-03 | 1 | Disclosure1 |
| 2026-02-06 | 1 | Patch1 |
CVE-2026-24053 Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directo… https://www.cve.org/CVERecord?id=CVE-2026-24053
Post summary
A Bash command validation flaw in Claude Code’s ZSH clobber syntax parsing was disclosed in CVE-2026-24053, allowing directory bypass prior to version 2.0.74.
CVE-2026-24053: ZSH clobber (>|) Bypass → File Writes außerhalb des Workspaces möglich. CVE-2026-24887: Command Injection im 'find' Befehl → User-Approval Bypass. Fix: brew upgrade claude-code 🛡️ Stay safe.
Post summary
The post announces two CVEs, briefly explains their technical impact, and recommends applying a patch via 'brew upgrade claude-code'.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | anthropic | claude_code | - | node.js | - |