CVE-2026-24887: Anthropic Claude Code command injection in find command

CVE-2026-24887 · Severity: medium · CVSS 4 · Published 2026-02-03

Claude Code is an AI-powered code generation and execution tool that runs commands on developers' machines. A vulnerability in command parsing allows attackers to bypass the user confirmation prompt and execute untrusted system commands, such as reading files or installing malware. Exploitation requires the ability to inject malicious content into Claude's context window, such as through a crafted file or prompt.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-24887 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24887 being exploited in the wild.
How severe is CVE-2026-24887?
Medium severity, with a CVSS score of 4, published 3 February 2026.
Which products and versions are affected?
Anthropic Claude Code < 2.0.72; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.72.
Is there a fix for CVE-2026-24887?
Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.72 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24887 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24887?
Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 2.0.72 or later
    npm install @anthropic-ai/claude-code@2.0.72

Technical details

Claude Code contains a command injection vulnerability (CWE-78, CWE-94) in its find command parsing logic that permits bypass of the user approval confirmation prompt. The vulnerability allows an attacker to inject shell metacharacters that are not properly sanitized before command execution. Exploitation requires network access and the ability to add untrusted content to the Claude Code context window (e.g., by providing a malicious file or prompt), with passive user interaction (the user runs Claude Code but does not explicitly approve the injected command). An attacker can achieve arbitrary command execution with the privileges of the Claude Code process. The fix was released in version 2.0.72 and has been automatically deployed to users on auto-update.

Affected products

  • Anthropic Claude Code < 2.0.72

Identifiers

  • CVE-2026-24887
  • GHSA-qgqw-h4xq-7w8w

Timeline

  • 2026-02-03: disclosed
  • 2026-02-03: patched: Version 2.0.72 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.