Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.72.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-03 | 1 | Disclosure1 |
| 2026-02-06 | 2 | General1Patch1 |
| 2026-05-05 | 1 | Patch1 |
| 2026-05-07 | 1 | Active Exploitation1 |
| 2026-05-11 | 1 | Patch1 |
Claude Code Update-Check: CVE-2026-24887 & 24053 sind keine Kleinigkeit. Wer agentische Tools nutzt, muss Hardening ernst nehmen. 🔒 🧵 Die Details warum das ZSH Clobber Parsing gefährlich war:
Post summary
The post highlights CVE-2026-24887 and CVE-2026-24053 as serious ZSH clobber parsing issues, urging hardening for users of agentic tools, but provides no technical, exploit, or patch details.
CVE-2026-24887 Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to t… https://www.cve.org/CVERecord?id=CVE-2026-24887
Post summary
CVE‑2026‑24887 describes a command‑parsing flaw in Claude Code that permitted bypass of a confirmation prompt in versions before 2.0.72; the post provides technical detail but no PoC, exploit, or patch information.
CVE-2026-21852, CVE-2026-24887, CVE-2026-39861. Three Claude Code CVEs in one cycle: API-key exfil before the trust prompt, command injection via the find call, sandbox escape via symlink. Fixes shipped in 2.0.72 and 2.1.64. The SaaS Claude Code surface IS the threat surface. Self-hosted Claude Code with strict allowlists kills all three classes. https://aigeneral.net
Post summary
Three new Claude Code CVEs—API‑key exfiltration, command injection, and sandbox escape—have been disclosed with patches released and mitigations advised.
CVE-2026-24887. CVE-2026-21852. CVE-2025-59536. Three Claude Code RCEs in 60 days, all weaponized faster after Anthropic shipped the full source map in a public npm bundle on March 31. The SaaS surface IS the threat surface. Self-hosted Claude Code behind strict allowlists kills the class. https://aigeneral.net
Post summary
Three remote code execution exploits in Claude Code were weaponized within 60 days after Anthropic published a public npm source map, exposing the SaaS surface as the main threat vector, with no patches or mitigations cited.
CVE-2026-24887: Claude Code <2.0.72 lets a malicious prompt bypass confirmation and run shell commands. Anthropic patched it. Every confirmation gate is one function call away from being skipped. Sandbox the agent, not the prompt. https://aigeneral.net
Post summary
Anthropic has patched CVE‑2026‑24887, a prompt‑bypass vulnerability in Claude that could allow shell command execution. The post highlights the patch and provides basic vulnerability details but no evidence of active exploitation.
CVE-2026-24053: ZSH clobber (>|) Bypass → File Writes außerhalb des Workspaces möglich. CVE-2026-24887: Command Injection im 'find' Befehl → User-Approval Bypass. Fix: brew upgrade claude-code 🛡️ Stay safe.
Post summary
The tweet reports two vulnerabilities (ZSH clobber bypass and command injection in find) and offers a patch via "brew upgrade claude-code"; no PoC, exploit code, or active exploitation is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | anthropic | claude_code | - | node.js | - |