Executive Summary

CVE-2026-33068 is a vulnerability in Claude Code versions prior to 2.1.53 where the tool improperly handled permission modes from repository-controlled settings files.

Specifically, the tool resolved permission modes from the .claude/settings.json file before deciding whether to show the workspace trust confirmation dialog.

A malicious repository could set the permissions.defaultMode field to bypassPermissions in this settings file, causing the trust dialog to be silently skipped when the workspace is first opened.

This allowed attackers to place users into a permissive mode without explicit user consent, enabling execution of potentially harmful tools controlled by the attacker.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker-controlled repository to bypass the workspace trust confirmation dialog and execute malicious code without your explicit consent.

Because the trust dialog is skipped silently, users may unknowingly run code in a permissive mode, increasing the risk of compromise.

Successful exploitation affects the confidentiality, integrity, and availability of your system at a high level.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves a malicious repository setting the permissions.defaultMode field to bypassPermissions in the committed .claude/settings.json file to silently skip the workspace trust confirmation dialog.'}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you can inspect the .claude/settings.json file within your repositories for the presence of the permissions.defaultMode field set to bypassPermissions.'}, {'type': 'paragraph', 'content': 'For example, you can run the following command in your repository root to check for this setting:'}, {'type': 'list_item', 'content': "grep -r 'permissions.defaultMode' .claude/settings.json"}, {'type': 'list_item', 'content': 'or to find any .claude/settings.json files containing bypassPermissions anywhere in your project:'}, {'type': 'list_item', 'content': "grep -r 'bypassPermissions' .claude/settings.json"}, {'type': 'paragraph', 'content': 'If such entries are found, it indicates the repository may be exploiting this vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in Claude Code version 2.1.53.

Immediate mitigation steps include upgrading Claude Code to version 2.1.53 or later.

Users relying on automatic updates may have already received the patch, but manual updaters should update promptly.

Additionally, review and remove any malicious or suspicious .claude/settings.json files in your repositories that set permissions.defaultMode to bypassPermissions.

Useful 0 Not Useful 0