CVE-2026-24053: @anthropic-ai/claude-code Path Restriction Bypass via ZSH Clobber Allows Arbitrary File Writes
Summary
CVE-2026-24053: Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes. Affects @anthropic-ai/claude-code versions < 2.0.74. Fixed in 2.0.74. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code, developed by Anthropic AI, is a powerful tool designed for code generation and assistance, leveraging advanced AI capabilities. It is widely used for enhancing productivity in software development. However, a recent vulnerability has been identified that allows unauthorized file writes due to improper handling of ZSH clobber syntax, which can lead to significant security risks.
Vulnerability Detail
The vulnerability arises from a flaw in the Bash command validation process when parsing ZSH clobber syntax. This flaw allows an attacker to bypass directory restrictions, enabling them to write files outside the intended working directory without prompting for user permission. Exploiting this vulnerability requires the user to be utilizing ZSH and to have the ability to insert untrusted content into a Claude Code context window. The potential ramifications include unauthorized data manipulation and exposure of sensitive information.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.74
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.0.74Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using ZSH or refrain from adding untrusted content into the Claude Code context window until the package is updated.
Conclusion
The CVE-2026-24053 vulnerability in the @anthropic-ai/claude-code package poses significant security risks due to improper handling of ZSH clobber syntax. Users are strongly advised to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
The vulnerability allows arbitrary file writes due to a flaw in parsing ZSH clobber syntax, enabling directory restriction bypass.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized file writes, data manipulation, and potential exposure of sensitive information.
Yes, the patch is available in version 2.0.74 of the @anthropic-ai/claude-code package.
If immediate updating is not possible, avoid using ZSH and refrain from adding untrusted content into the Claude Code context window.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
