Is CVE-2026-33068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33068 being exploited in the wild.

How severe is CVE-2026-33068?

Medium severity, with a CVSS score of 4, published 19 March 2026.

Which products and versions are affected?

Anthropic Claude Code before 2.1.53; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.1.53.

Is there a fix for CVE-2026-33068?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33068 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33068?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33068: Anthropic Claude Code workspace trust dialog bypass via settings file

CVE-2026-33068 · Severity: medium · CVSS 4 · Published 2026-03-19

Claude Code is a development tool that integrates AI code generation into IDEs with permission controls to protect user systems. A malicious repository could manipulate the tool's settings file to silently skip the workspace trust confirmation dialog, allowing attackers to execute code without explicit user consent. This could enable unauthorized access to user files, credentials, and system resources through attacker-controlled repository code.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-33068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33068 being exploited in the wild.
How severe is CVE-2026-33068?: Medium severity, with a CVSS score of 4, published 19 March 2026.
Which products and versions are affected?: Anthropic Claude Code before 2.1.53; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.1.53.
Is there a fix for CVE-2026-33068?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33068 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33068?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.1.53 or later
```
npm install @anthropic-ai/claude-code@2.1.53
```

Technical details

The vulnerability is an authorization bypass (CWE-807) in the permission resolution logic of Claude Code. The tool resolves the defaultMode permission from repo-controlled .claude/settings.json before displaying the workspace trust confirmation dialog, rather than after. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed settings file, causing the trust dialog to be silently skipped on first open. This places the user into a permissive mode without explicit consent, enabling attacker-controlled code execution. The attack requires network delivery of a malicious repository but no special privileges or authentication. The vulnerability was patched in version 2.1.53; users on auto-update have already received the fix.

Affected products

Anthropic Claude Code before 2.1.53

Identifiers

CVE-2026-33068
GHSA-mmgp-wc2j-qcv7

Timeline

2026-03-19: disclosed
2026-03-19: patched: version 2.1.53

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.