Claude Code, an agentic coding tool, had a flaw in its Bash command validation that allowed the parsing of ZSH clobber syntax to bypass directory restrictions and write files outside the current working directory. The vulnerability, identified as CWE‑22 and CWE‑79, means an attacker can create or overwrite arbitrary files on the host system without any user permission prompt. The effect is a compromise of file-system integrity and potentially the confidentiality of data if sensitive files are overwritten or malicious code is injected.

The flaw affects versions of Claude Code prior to 2.0.74 released by Anthropic. The vulnerability applies to the standard node.js binary distribution of the tool and requires the user to be running ZSH to trigger the clobber syntax. No specific sub‑versions beyond the 2.0.74 threshold are listed as affected.

The CVSS score of 7.7 indicates a high severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have the ability to inject untrusted content into a Claude Code context window while the shell engine is ZSH. The attack surface is limited to users who have run Claude Code with ZSH and have provided contextual input that contains the clobber syntax. Based on the description, the likely attack vector is through crafted user input in the context window rather than a network-based payload.