CVE-2026-24053: Arbitrary File Access in @anthropic-ai/claude-code

An attacker exploiting this vulnerability could potentially gain unauthorized access to files and directories outside the intended scope within the Claude Code environment. This could lead to data exfiltration, modification of critical files, or even the execution of arbitrary code if the attacker can leverage the file write access to create and execute malicious scripts. The attack requires the user to be using ZSH and to be able to inject untrusted content into a Claude Code context window, limiting the immediate attack surface but still posing a significant risk in environments where such conditions are met.

1. Reserved2026-01-20
2. Published2026-02-03
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24053 is to immediately update the @anthropic-ai/claude-code package to version 2.0.74 or later. For environments where immediate upgrades are not feasible, consider restricting user input within the Claude Code context window to prevent the injection of malicious ZSH commands. While a direct WAF rule is unlikely to be effective, input validation and sanitization routines should be reviewed to ensure they adequately handle potentially malicious characters and command sequences. After upgrading, verify the fix by attempting to write a file outside the intended working directory using a ZSH command within a Claude Code context window; the operation should be denied.