npm/@anthropic-ai/claude-code CVE-2026-24053: medium 6.5, EPSS 0.51%

Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

Action: Upgrade @anthropic-ai/claude-code to 2.0.74 or later.

npm i @anthropic-ai/claude-code@2.0.74

Affected

Fixed versions

Sources

• osv: GHSA-q728-gf8j-w49r
• nvd: CVE-2026-24053
• https://github.com/anthropics/claude-code/security/advisories/GHSA-q728-gf8j-w49r
• https://github.com/anthropics/claude-code

CVE-2026-24053 · published 2026-02-03T19:32:01Z · modified 2026-02-04T22:42:25.762Z · JSON