Is CVE-2026-24053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24053 being exploited in the wild.

How severe is CVE-2026-24053?

Medium severity, with a CVSS score of 4, published 3 February 2026.

Which products and versions are affected?

Anthropic Claude Code < 2.0.74; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.74.

Is there a fix for CVE-2026-24053?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24053 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-24053?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24053: Anthropic Claude Code path restriction bypass via ZSH clobber

Q: Is there a fix for CVE-2026-24053?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-24053 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-24053?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24053 · Severity: medium · CVSS 4 · Published 2026-02-03

Claude Code is an AI code execution environment used by developers to run code within Claude's AI interface. A vulnerability in Bash command parsing allows attackers who can inject untrusted code into a Claude Code session to write files outside the intended working directory, bypassing security restrictions—potentially compromising sensitive files on the developer's system without their knowledge or permission.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-24053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24053 being exploited in the wild.
How severe is CVE-2026-24053?: Medium severity, with a CVSS score of 4, published 3 February 2026.
Which products and versions are affected?: Anthropic Claude Code < 2.0.74; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.74.
Is there a fix for CVE-2026-24053?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24053 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-24053?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later
```
npm install @anthropic-ai/claude-code@2.0.74
```

Technical details

The vulnerability is a path restriction bypass (CWE-22) and command injection issue (CWE-78) in Claude Code's Bash command validation logic. Due to improper parsing of ZSH clobber syntax (specifically `>|` operators), an attacker can escape directory restrictions that normally confine file writes to the current working directory. Exploitation requires the user to run ZSH as their shell and for the attacker to inject untrusted content into a Claude Code context window—a plausible scenario when processing user-provided code snippets or AI-generated code. An authenticated user, without triggering permission prompts, can write arbitrary files to any location accessible to the Claude Code process. The vulnerability has been patched in version 2.0.74; users on auto-update have received fixes, while others must manually update.

Affected products

Anthropic Claude Code < 2.0.74

Identifiers

CVE-2026-24053
GHSA-q728-gf8j-w49r

Timeline

2026-02-03: disclosed
2026-02-03: patched: version 2.0.74

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.