CVE-2026-24887: 
Claude Code vulnerability analysis and mitigation

CVE-2026-24887 is a command injection vulnerability in Anthropic's Claude Code agentic coding tool, titled "Command Injection in find Command Bypasses User Approval Prompt." Due to an error in command parsing, attackers can bypass Claude Code's confirmation prompt and trigger execution of untrusted commands through the find command. All versions of the @anthropic-ai/claude-code npm package prior to 2.0.72 are affected. The vulnerability was disclosed on February 3, 2026, and carries a CVSS v4 base score of 7.7 (High) and a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Github Advisory DB).

The root cause is improper neutralization of special elements used in OS commands (CWE-78) and improper control of code generation (CWE-94), stemming from a parsing error in how Claude Code constructs and executes find commands. This flaw allows specially crafted input injected into the Claude Code context window to bypass the user approval/confirmation prompt that is intended to gate execution of untrusted commands. Exploitation requires the attacker to have the ability to introduce untrusted content into a Claude Code context window — for example, via prompt injection through malicious files, repositories, or web content processed by the tool. The vulnerability is network-reachable with low attack complexity, though attack requirements are noted as "Present" (i.e., specific deployment conditions must exist) (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary OS commands on the system running Claude Code without triggering the user confirmation prompt, effectively bypassing a key security control. This can result in full compromise of confidentiality, integrity, and availability of the affected Claude Code environment — including unauthorized access to sensitive files and credentials, modification or deletion of system data, and potential system downtime. Given that Claude Code typically operates with the privileges of the developer running it, exploitation could expose source code, secrets, API keys, and other sensitive development artifacts (Github Advisory DB, Feedly).

There is no confirmed public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.068% (21st percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported to Anthropic via HackerOne by researcher alexbernier and was patched prior to broad public disclosure (GitHub Advisory).

1. Identify a target: Locate a developer or system running Claude Code versions prior to 2.0.72 that processes external or untrusted content (e.g., open-source repositories, user-supplied files, or web-fetched content).
2. Craft a malicious payload: Prepare content containing a specially crafted string that exploits the find command parsing error — embedding OS command injection sequences (e.g., using shell metacharacters such as ;, &&, |, or -exec flags) designed to be interpreted as executable commands rather than arguments.
3. Inject into context window: Introduce the malicious content into the Claude Code context window. This could be achieved via a malicious file in a repository being analyzed, a crafted prompt, or any other mechanism by which untrusted content is fed into the tool's context.
4. Bypass confirmation prompt: Due to the parsing error, Claude Code fails to correctly identify the injected command as requiring user approval, and the find command executes the attacker-controlled payload without prompting the user.
5. Achieve arbitrary command execution: The injected command runs with the privileges of the Claude Code process, enabling data exfiltration, persistence, or further lateral movement within the developer's environment (GitHub Advisory, Github Advisory DB).

• Process: Unexpected child processes spawned by the Claude Code Node.js process (e.g., /bin/sh, /bin/bash, curl, wget, python, nc) without corresponding user confirmation events.
• Logs: System audit logs (e.g., auditd, macOS Unified Log) showing find command executions with unusual -exec arguments or shell metacharacters originating from the Claude Code process.
• File System: Unexpected new files, scripts, or cron jobs created in the user's home directory or project directories during a Claude Code session; presence of exfiltration tools or reverse shell scripts.
• Network: Outbound network connections from the Claude Code process to unexpected external IP addresses or domains, particularly shortly after processing external/untrusted content.

Anthropic has released a patch in Claude Code version 2.0.72, which corrects the command parsing error. Users on standard Claude Code auto-update have already received this fix automatically. Users performing manual updates should immediately upgrade to version 2.0.72 or later via npm install -g @anthropic-ai/claude-code. As a temporary workaround prior to patching, organizations should restrict Claude Code from processing untrusted or externally sourced content in its context window (GitHub Advisory, Github Advisory DB).

The vulnerability was responsibly disclosed by security researcher alexbernier via HackerOne and credited in the official Anthropic advisory. The advisory was published by Anthropic's security team (ddworken) on February 3, 2026. Community tracking has been noted on platforms including NixOS package management (a GitHub issue was opened to track the update in nixpkgs), and the vulnerability has been indexed by multiple vulnerability aggregators. No major media coverage or significant social media controversy has been identified beyond standard vulnerability tracking (GitHub Advisory).