Claude Code Command Injection Vulnerability in find Command Prior to Version 2.0.72

A command injection vulnerability has been identified in Claude Code, an agentic coding tool, in versions prior to 2.0.72. The issue arises from a flaw in command parsing that allows users to bypass the confirmation prompt and execute untrusted commands via the find command. Exploitation of this vulnerability requires the ability to introduce untrusted content into a Claude Code context window.

Impact

Exploitation of this vulnerability allows for command injection, enabling the execution of untrusted commands without user approval.

Remediation

Users on standard Claude Code auto-update have already received the patch. Those performing manual updates should update to the latest version.