Claude Code ZSH Clobber Syntax Vulnerability Allows Unauthorized File Writes

A vulnerability in Claude Code prior to version 2.0.74 allows users to bypass directory restrictions and write files outside the current working directory without user permission prompts. This issue arises from a flaw in Bash command validation related to ZSH clobber syntax. Exploitation requires the user to be using ZSH and to have the ability to insert untrusted content into a Claude Code context window.

Impact

Exploitation of this vulnerability could lead to unauthorized file writes, potentially allowing for the manipulation or creation of files in unintended locations.

Remediation

Users on standard Claude Code auto-update have received this fix. Users performing manual updates should update to the latest version.