Alex Bernier

**Name of the Vulnerable Software and Affected Versions** Claude Code versions prior to 2.0.74 **Description** Claude Code is an agentic coding tool affected by a Bash command validation flaw when parsing ZSH clobber syntax. This flaw allowed bypassing directory restrictions and writing files outside the current working directory without user permission prompts. Exploitation required the use of ZSH and the ability to add untrusted content into a Claude Code context window. **Recommendations** Update to version 2.0.74 or later.

**Name of the Vulnerable Software and Affected Versions** Claude Code versions prior to 2.0.72 **Description** Claude Code is an agentic coding tool. A flaw in command parsing allowed bypassing the confirmation prompt, potentially triggering the execution of untrusted commands via the `find` command. Successful exploitation required the ability to inject untrusted content into a Claude Code context window. The issue was addressed in version 2.0.72. **Recommendations** Update to version 2.0.72 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The Microsoft Edge Elevation Service has a design flaw where a privileged COM interface does not properly check the permissions of the process making the request. A standard local user can use the `LaunchUpdateCmdElevatedAndWait` method of the `IElevatorEdge` interface to run commands with LocalSystem privileges. This allows a non-administrator to modify protected registry keys under `HKLMSYSTEMCurrentControlSetControlDeviceGuard`, specifically to disable Windows Virtualization-Based Security (VBS). Disabling VBS reduces the effectiveness of security features like Credential Guard, Hypervisor-protected Code Integrity (HVCI), and the Secure Kernel, leading to a security bypass. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.