Executive brief
Claude Code is a development tool that integrates AI code generation into IDEs with permission controls to protect user systems. A malicious repository could manipulate the tool's settings file to silently skip the workspace trust confirmation dialog, allowing attackers to execute code without explicit user consent. This could enable unauthorized access to user files, credentials, and system resources through attacker-controlled repository code.
Technical details
The vulnerability is an authorization bypass (CWE-807) in the permission resolution logic of Claude Code. The tool resolves the defaultMode permission from repo-controlled .claude/settings.json before displaying the workspace trust confirmation dialog, rather than after. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed settings file, causing the trust dialog to be silently skipped on first open. This places the user into a permissive mode without explicit consent, enabling attacker-controlled code execution. The attack requires network delivery of a malicious repository but no special privileges or authentication. The vulnerability was patched in version 2.1.53; users on auto-update have already received the fix.
Affected products
- Anthropic Claude Code before 2.1.53
Timeline
- 2026-03-19: disclosed
- 2026-03-19: patched: version 2.1.53