Claude Code contains an error in command parsing that allows an attacker to bypass the confirmation prompt and execute arbitrary shell commands via the find command. The flaw supports command injection (CWE‑78) and dynamic code generation (CWE‑94). If an attacker can insert untrusted content into a Claude Code context window, they can trigger arbitrary code execution on the host running the tool, compromising confidentiality, integrity, and availability of the system.

Anthropic Claude Code up to version 2.0.72 is affected. Versions 2.0.72 and later contain the fix. The product runs on Node.js environments.

The CVSS base score of 7.7 indicates a medium‑to‑high severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to introduce malicious content into the agent’s context window; once injected, the command injection can be triggered without user confirmation. Attackers with such access could run arbitrary commands, making this a high‑consequence flaw for systems that rely on anonymous or untrusted input.