PT-2026-26297 · Npm · @Anthropic-Ai/Claude-Code

Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-33068

OSV

CVSS v4.0

7.7

High

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Claude Code resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/cantina xyz for reporting this issue.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2026-33068

GHSA-MMGP-WC2J-QCV7

Affected Products

@Anthropic-Ai/Claude-Code

References · 3

• https://osv.dev/vulnerability/GHSA-mmgp-wc2j-qcv7 · Vendor Advisory
• https://github.com/anthropics/claude-code · Note
• https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7 · Note