{"data":{"id":"12185261-1038-4c9a-9be4-9a92363c24f0","title":"CVE-2026-24887: Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to…","summary":"CVE-2026-24887 affects Claude Code, an agentic coding tool, prior to version 2.0.72. A command parsing error let an attacker bypass the confirmation prompt and run untrusted commands through the find command. Exploitation reliably required the ability to add untrusted content into the Claude Code context window.","solution":"Fixed in version 2.0.72.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24887","publishedAt":"2026-02-03T21:16:13.433Z","cveId":"CVE-2026-24887","cweIds":["CWE-78","CWE-94"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 2.0.72 (fixed: 2.0.72)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code confirmation prompt bypass via find command","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00642,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":["GHSA-qgqw-h4xq-7w8w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:03.671Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-17T21:21:00.969Z","daysToFix":-48,"fixCheckedAt":"2026-10-29T21:41:51.001Z","capecIds":["CAPEC-242","CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"2.0.72","matchedVersion":"2.0.72","fixReleasedAt":"2025-12-17T21:21:00.969Z","daysToFix":-48,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:41:50.850Z"}]}}