CVE-2026-33068
Permission Bypass in Claude Code via Malicious Settings File
Publication date: 2026-03-20
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anthropic | claude_code | to 2.1.53 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-807 | The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33068 is a vulnerability in Claude Code versions prior to 2.1.53 where the tool improperly handled permission modes from repository-controlled settings files.
Specifically, the tool resolved permission modes from the .claude/settings.json file before deciding whether to show the workspace trust confirmation dialog.
A malicious repository could set the permissions.defaultMode field to bypassPermissions in this settings file, causing the trust dialog to be silently skipped when the workspace is first opened.
This allowed attackers to place users into a permissive mode without explicit user consent, enabling execution of potentially harmful tools controlled by the attacker.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker-controlled repository to bypass the workspace trust confirmation dialog and execute malicious code without your explicit consent.
Because the trust dialog is skipped silently, users may unknowingly run code in a permissive mode, increasing the risk of compromise.
Successful exploitation affects the confidentiality, integrity, and availability of your system at a high level.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves a malicious repository setting the permissions.defaultMode field to bypassPermissions in the committed .claude/settings.json file to silently skip the workspace trust confirmation dialog.'}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you can inspect the .claude/settings.json file within your repositories for the presence of the permissions.defaultMode field set to bypassPermissions.'}, {'type': 'paragraph', 'content': 'For example, you can run the following command in your repository root to check for this setting:'}, {'type': 'list_item', 'content': "grep -r 'permissions.defaultMode' .claude/settings.json"}, {'type': 'list_item', 'content': 'or to find any .claude/settings.json files containing bypassPermissions anywhere in your project:'}, {'type': 'list_item', 'content': "grep -r 'bypassPermissions' .claude/settings.json"}, {'type': 'paragraph', 'content': 'If such entries are found, it indicates the repository may be exploiting this vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in Claude Code version 2.1.53.
Immediate mitigation steps include upgrading Claude Code to version 2.1.53 or later.
Users relying on automatic updates may have already received the patch, but manual updaters should update promptly.
Additionally, review and remove any malicious or suspicious .claude/settings.json files in your repositories that set permissions.defaultMode to bypassPermissions.