claude-code - 💡(How to fix) Fix Bundled [email protected] affected by CVE-2026-33671 (ReDoS via extglob) [1 participants]

TL;DR

Update @anthropic-ai/claude-code to use [email protected] or later to address the CVE-2026-33671 vulnerability.

Guidance

• Verify the vulnerability by checking the version of picomatch bundled with @anthropic-ai/claude-code using npm ls picomatch or similar commands.
• Consider publishing a patch release of @anthropic-ai/claude-code that updates the dependency to [email protected] or later.
• Although the vulnerability is not exploitable in the context of claude-code, updating the dependency can help avoid false positives from image scanners.
• If a patch release is not feasible, provide documentation or notices to users and image scanners explaining the non-exploitable nature of the vulnerability in claude-code.

Notes

The issue is specific to the global installation of @anthropic-ai/claude-code and the bundled version of picomatch. The vulnerability is not exploitable due to the lack of user-controlled glob input reaching picomatch.

Recommendation

Apply workaround: Publish a patch release of @anthropic-ai/claude-code that updates the picomatch dependency to 4.0.4 or later to address the vulnerability and avoid false positives from image scanners.