AI agent vulnerability · Claude Code

CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

highCVSS 4.0 7.7GHSA-mmgp-wc2j-qcv7

Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open.

Published Mar 19, 2026 · Updated Mar 20, 2026

Affected packages

@anthropic-ai/claude-code

Ecosystem: npm
Affected: < 2.1.53
Fixed in: 2.1.53
Check: npm ls @anthropic-ai/claude-code

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/cantina_xyz for reporting this issue.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Claude Code vulnerabilities

All Claude Code entries