CVE-2026-33068highCWE-807

CVE-2026-33068: high-severity vulnerability in anthropics claude-code

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Published

Follow this CVE+ Monitor claude-code+ Monitor @anthropic-ai/claude-code

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.4%
In short

Claude Code skipped its security dialog when opening untrusted repositories if they contained a malicious settings file. This allowed attackers to execute code on a user's computer without the user seeing a warning prompt.

Technical detail

CWE-807 (Reliance on Untrusted Inputs in a Security Decision): Claude Code versions <2.1.53 resolved permissions from repo-controlled .claude/settings.json before evaluating workspace trust, allowing a malicious repository to set permissions.defaultMode to bypassPermissions and suppress the trust confirmation dialog. The attack requires user interaction (opening the repository) but bypasses the explicit security control designed to require informed consent.

Summary generated and translated by AI from the official description.
Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/settings.json, before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent. This issue has been patched in version 2.1.53.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
anthropics · claude-code
Related CVEs — anthropics claude-code

In the same product, most dangerous first.

CVE-2026-21852MEDIUMClaude Code Leaks Data via Malicious Environment Configuration Before Trust ConfirmationEPSS 27.5%CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 24.9%CVE-2025-54794HIGHClaude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessEPSS 1.5%CVE-2025-54795HIGHClaude Code echo command allowed bypass of user approval prompt for command executionEPSS 1.1%CVE-2025-66032HIGHClaude Code Command Validation Bypass Allows Arbitrary Code ExecutionEPSS 0.7%CVE-2026-39861HIGHClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceEPSS 0.7%