CVE-2026-24887: Command Injection in @anthropic-ai/claude-code

Successful exploitation of CVE-2026-24887 allows an attacker to execute arbitrary commands on the system running the @anthropic-ai/claude-code package. This is achieved by manipulating the context window to inject malicious commands that bypass the intended confirmation process. The impact can range from information disclosure (reading sensitive files) to complete system takeover, depending on the privileges of the process running the package. The requirement to add untrusted content into the context window introduces a dependency on the attacker's ability to influence the input provided to Claude Code, but once achieved, the command execution is relatively straightforward. This vulnerability shares similarities with other command injection flaws where improper input sanitization leads to unintended command execution.

1. Reserved2026-01-27
2. Published2026-02-03
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24887 is to upgrade to version 2.0.72 or later of the @anthropic-ai/claude-code package. For environments where immediate upgrades are not feasible, consider implementing input validation and sanitization on any data passed to the 'find' command within the package. While a direct WAF rule is unlikely to be effective due to the nature of the vulnerability, restricting the context window input and carefully reviewing the data sources used by Claude Code can reduce the attack surface. There are no specific rollback steps beyond reverting to a previous, vulnerable version, which is not recommended. After upgrading, confirm the fix by attempting to inject malicious commands into the context window and verifying that the confirmation prompt is enforced.