npm/@anthropic-ai/claude-code CVE-2026-24887: high 8.8, EPSS 0.64%

Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

Action: Upgrade @anthropic-ai/claude-code to 2.0.72 or later.

npm i @anthropic-ai/claude-code@2.0.72

Affected

Fixed versions

Sources

• osv: GHSA-qgqw-h4xq-7w8w
• nvd: CVE-2026-24887
• https://github.com/anthropics/claude-code/security/advisories/GHSA-qgqw-h4xq-7w8w
• https://github.com/anthropics/claude-code

CVE-2026-24887 · published 2026-02-03T19:33:32Z · modified 2026-02-03T22:34:25.261494Z · JSON