Read the docs
TI-2026-25510 Aliases CVE-2026-33068GHSA-mmgp-wc2j-qcv7

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Priority LOW 36CWE-807Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent. This issue has been patched in version 2.1.53.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed claude-code (anthropics): 2.1.53@anthropic-ai/claude-code (npm): 2.1.53

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anthropicsclaude-codebefore 2.1.532.1.53Patch availableCNA
—@anthropic-ai/claude-code (npm)before 2.1.532.1.53Patch availableGHSA-mmgp-wc2j-qcv7
  • claude-code Vendoranthropics Affected before 2.1.53 Fixed in 2.1.53 Patch available CNA
  • @anthropic-ai/claude-code (npm) Vendor— Affected before 2.1.53 Fixed in 2.1.53 Patch available GHSA-mmgp-wc2j-qcv7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*before 2.1.53Vulnerableanthropics
  • cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:* Versions before 2.1.53 Vulnerable ·anthropics

Remediation

  • Fix · CNA claude-code (anthropics) Fixed in 2.1.53
  • Fix · GHSA-mmgp-wc2j-qcv7 @anthropic-ai/claude-code (npm) Fixed in 2.1.53 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33068
  2. 2026-10-03 Alias added: GHSA-mmgp-wc2j-qcv7

References

Advisory 2

Other 1

  • TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
  • TI-2025-37066 Claude Code's startup trust dialog could lead to Command Execution attack CVSS 4.0HIGH 8.7
  • TI-2026-17554 Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation CVSS 4.0MEDIUM 5.3
  • TI-2025-40093 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes CVSS 4.0HIGH 8.7
  • TI-2025-36422 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution CVSS 4.0HIGH 8.7
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences