Medium severity · published Feb 3, 2026
CVE-2026-24053
Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
claude-code · anthropics
< 2.0.74 · source: vendor
CC
Claude Code · Anthropic
before 2.0.74 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24053
Vendor Advisory
https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r
More from claude-code
10.0
CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
10.0
CVE-2026-25725
Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json
9.8
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
9.8
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
9.8
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog