CVE-2026-24053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24053", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.778Z", "datePublished": "2026-02-03T20:49:59.261Z", "dateUpdated": "2026-02-03T21:22:27.265Z"}, "containers": {"cna": {"title": "Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r"}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"version": "< 2.0.74", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T20:49:59.261Z"}, "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74."}], "source": {"advisory": "GHSA-q728-gf8j-w49r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T21:22:17.897905Z", "id": "CVE-2026-24053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T21:22:27.265Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T21:22:17.897905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T21:22:21.302Z"}}], "cna": {"title": "Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes", "source": {"advisory": "GHSA-q728-gf8j-w49r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"status": "affected", "version": "< 2.0.74"}]}], "references": [{"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r", "name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T20:49:59.261Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24053", "state": "PUBLISHED", "dateUpdated": "2026-02-03T21:22:27.265Z", "dateReserved": "2026-01-20T22:30:11.778Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T20:49:59.261Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "claude-code", "vendor": "anthropics", "versions": [{"status": "affected", "version": "< 2.0.74"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "FA3D1A9F-D160-49C8-99DF-683EAE2D6CF5", "versionEndExcluding": "2.0.74", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74."}, {"lang": "es", "value": "Claude Code es una herramienta de codificaci\u00f3n ag\u00e9ntica. Antes de la versi\u00f3n 2.0.74, debido a una falla de validaci\u00f3n de comandos Bash al analizar la sintaxis de sobrescritura de ZSH, era posible eludir las restricciones de directorio y escribir archivos fuera del directorio de trabajo actual sin avisos de permiso del usuario. Explotar esto requer\u00eda que el usuario utilizara ZSH y la capacidad de a\u00f1adir contenido no confiable en una ventana de contexto de Claude Code. Este problema ha sido parcheado en la versi\u00f3n 2.0.74."}], "id": "CVE-2026-24053", "lastModified": "2026-06-17T10:22:31.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24053", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T21:22:17.897905Z", "version": "2.0.3"}}]}, "published": "2026-02-03T21:16:13.220", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:03:49.502737+00:00", "value": {"mitigation_remediation": ["Upgrade Claude\u00a0Code to version 2.0.74 or later to receive the fix for the clobber\u2011syntax validation flaw.", "If an upgrade is not immediately possible, avoid using ZSH when executing Claude\u00a0Code or remove any ZSH clobber syntax from context windows.", "Ensure that only trusted content is added to context windows and validate all input before it reaches the command\u2011parsing stage."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Write"}, "threat_synthesis": {"affected_systems": "The flaw affects versions of Claude\u00a0Code prior to 2.0.74 released by Anthropic. The vulnerability applies to the standard node.js binary distribution of the tool and requires the user to be running ZSH to trigger the clobber syntax. No specific sub\u2011versions beyond the 2.0.74 threshold are listed as affected.", "description_and_impact": "Claude\u00a0Code, an agentic coding tool, had a flaw in its Bash command validation that allowed the parsing of ZSH clobber syntax to bypass directory restrictions and write files outside the current working directory. The vulnerability, identified as CWE\u201122 and CWE\u201179, means an attacker can create or overwrite arbitrary files on the host system without any user permission prompt. The effect is a compromise of file-system integrity and potentially the confidentiality of data if sensitive files are overwritten or malicious code is injected.", "risk_and_exploitability": "The CVSS score of 7.7 indicates a high severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have the ability to inject untrusted content into a Claude\u00a0Code context window while the shell engine is ZSH. The attack surface is limited to users who have run Claude\u00a0Code with ZSH and have provided contextual input that contains the clobber syntax. Based on the description, the likely attack vector is through crafted user input in the context window rather than a network-based payload."}}}}, "created": "2026-02-04T12:05:08.307264+00:00", "updated": "2026-04-18T00:15:31.772604+00:00", "vendors": ["anthropics", "anthropics$PRODUCT$claude_code"]}