# CVE-2026-24053: Anthropic Claude Code path restriction bypass via ZSH clobber

Source: https://junglewise.ai/threats/cve-2026-24053-anthropic-claude-code-path-restriction-bypass-via-zsh-clobber  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-24053 · Severity: medium · CVSS 4 · Published 2026-02-03

Claude Code is an AI code execution environment used by developers to run code within Claude's AI interface. A vulnerability in Bash command parsing allows attackers who can inject untrusted code into a Claude Code session to write files outside the intended working directory, bypassing security restrictions—potentially compromising sensitive files on the developer's system without their knowledge or permission.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-24053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24053 being exploited in the wild.

**How severe is CVE-2026-24053?** Medium severity, with a CVSS score of 4, published 3 February 2026.

**Which products and versions are affected?** Anthropic Claude Code < 2.0.74; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.74.

**Is there a fix for CVE-2026-24053?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24053 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-24053?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.0.74 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.0.74
  ```


## Technical details

The vulnerability is a path restriction bypass (CWE-22) and command injection issue (CWE-78) in Claude Code's Bash command validation logic. Due to improper parsing of ZSH clobber syntax (specifically `>|` operators), an attacker can escape directory restrictions that normally confine file writes to the current working directory. Exploitation requires the user to run ZSH as their shell and for the attacker to inject untrusted content into a Claude Code context window—a plausible scenario when processing user-provided code snippets or AI-generated code. An authenticated user, without triggering permission prompts, can write arbitrary files to any location accessible to the Claude Code process. The vulnerability has been patched in version 2.0.74; users on auto-update have received fixes, while others must manually update.

## Affected products

- Anthropic Claude Code < 2.0.74

## Identifiers

- CVE-2026-24053
- GHSA-q728-gf8j-w49r

## Timeline

- 2026-02-03: disclosed
- 2026-02-03: patched: version 2.0.74

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r](https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)