ACVE-2025-0004

The configuration

Configuration label

claude-code <0.2.111 + permissionMode auto|acceptEdits|bypassPermissions

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0; fixed 0.2.111)

Matcher

• all
  • all
    • harness.id eq "claude-code"
    • harness.version semverRange "<0.2.111"
  • some mcpServers
    • transport exists
  • permissionMode in [ "auto", "acceptEdits", "bypassPermissions" ]

Why it is exploitable

What the vulnerability is

Claude Code before 0.2.111 had a path-validation weakness in its project boundary. Prefix-style path checks could treat a path outside the current working directory as allowed when an attacker could arrange a matching prefix and place untrusted content into the context. The result can be unauthorized file access outside the intended project directory.

Which configuration is exposed

The exposed combination is Claude Code <0.2.111, at least one configured MCP server with a transport, and a permission mode of auto, acceptEdits, or bypassPermissions. These are exactly the matcher conditions: harness.id is claude-code, harness.version is below 0.2.111, mcpServers[].transport exists, and permissionMode is one of the three values. The finding does not assert that a particular server is malicious; it identifies a harness and context path in which untrusted input can matter.

How ACVE detects it

ACVE reads harness.id, harness.version, mcpServers[].transport, and permissionMode. It cannot see whether a transport actually delivered attacker-controlled content, whether a prefix-collision directory exists, or which files would be reachable. A match is therefore a configuration-aware exposure signal, not a reproduction of the traversal.

Fix

1. Upgrade Claude Code to 0.2.111 or later.
2. Use an approval-required permission mode while reviewing MCP context, and only enable less restrictive modes for trusted projects.

The permission-mode condition describes the approval posture at scan time; it does not claim that every configured transport is externally reachable.

The permission-mode condition describes the approval posture at scan time; it does not claim that every configured transport is externally reachable.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-54794

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Claude Code and require approval when untrusted MCP context is present.

Validation

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:23Z
• NVD: found; checked-at 2026-09-20T02:43:23Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:23Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-54794

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-54794