Executive brief
Claude Code is a terminal-based coding assistant developed by Anthropic. On Windows systems, it loaded configuration from a world-writable directory without permission checks, allowing an unprivileged local user to place a malicious configuration file that would be executed when any user on the system ran Claude Code. This could lead to unauthorized access to sensitive data, system modification, or system unavailability, but required shared multi-user access and user action to exploit.
Technical details
The vulnerability is an insecure search path issue (CWE-426) where Claude Code on Windows loaded system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or file permissions. Because Windows ProgramData is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created with restricted access, an unprivileged local user could create the directory and inject a malicious managed-settings.json file. Any user subsequently launching Claude Code on the same system would automatically load and execute this attacker-controlled configuration. The attack requires local system access, low privilege level, and user interaction (victim must launch Claude Code after the malicious file is placed). Impact is high: confidentiality, integrity, and availability of the victim's system could all be compromised. The fix is available in version 2.1.75 and later.
Affected products
- Anthropic @anthropic-ai/claude-code all versions before 2.1.75
Timeline
- 2026-04-17: disclosed
- 2026-04-17: patched: Fix available in version 2.1.75