PT-2026-26297 · Anthropic · Claude-Code

Cantina_Xyz · Published 2026-03-19 · Updated 2026-05-15 · CVE-2026-33068

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.53

Description Claude Code is an agentic coding tool that experienced a loading order issue in its settings loader. The software resolved the permission mode from settings files, such as the repository-controlled .claude/settings.json, before determining if the workspace trust confirmation dialog should be displayed. A malicious repository could set the permissions.defaultMode variable to bypassPermissions within its committed .claude/settings.json file, causing the trust dialog to be silently skipped upon the first time the repository is opened. This allows a user to be placed into a permissive mode without explicit consent, potentially enabling an attacker-controlled repository to achieve tool execution, file system access, and command execution.

Recommendations Update to version 2.1.53 or later. As a temporary mitigation, review the .claude/settings.json file in unfamiliar repositories to ensure the permissions.defaultMode variable is not set to bypassPermissions before opening them.

Exploit

Fix

LPE

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2026-33068

GHSA-MMGP-WC2J-QCV7

Affected Products

Claude-Code

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33068.json · Exploit
• https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmgp-wc2j-qcv7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33068 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33068 · Vendor Advisory
• https://github.com/anthropics/claude-code · Note
• https://raxe.ai/labs/advisories/RAXE-2026-040 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ry0nxp/resumen_diario_de_vulnerabilidades_19032026 · Reddit Post
• https://reddit.com/r/LocalLLM/comments/1s02dtx/if_you_use_claude_code_with_repositories_from · Reddit Post
• https://twitter.com/VulmonFeeds/status/2035025875729526915 · Twitter Post
• https://twitter.com/musiol_martin/status/2053403922765918336 · Twitter Post
• https://twitter.com/threatcluster/status/2049994850947215444 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1rz31be/anthropics_claude_code_cli_had_a_workspace_trust · Reddit Post
• https://twitter.com/CVEnew/status/2035627011964600403 · Twitter Post
• https://twitter.com/openclawradar/status/2035427486809358425 · Twitter Post