ACVE-2026-0003

The configuration

Configuration label

claude-code <999.0.0 + scope=project + permissionMode=bypassPermissions

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0; fixed 2.1.53)

Matcher

• all
  • some settingsFiles
    • all
      • scope eq "project"
      • keys contains "permissions.defaultMode"
  • harness.version semverRange "<999.0.0"
  • permissionMode eq "bypassPermissions"
  • harness.id eq "claude-code"

Why it is exploitable

What the vulnerability is

Claude Code project permissions can select an unsafe permission mode from repository-controlled settings. The specific combination in this advisory is a project setting containing permissions.defaultMode while the active harness mode is bypassPermissions. That combination can remove the approval boundary that would otherwise mediate tool or command execution.

Which configuration is exposed

The matcher requires a project-scoped settings file whose keys contains permissions.defaultMode, a Claude Code harness, a version below <999.0.0>, and permissionMode equal to bypassPermissions. Every condition is encoded; a user-scoped setting, a different permission mode, or a file without that key does not match this rule. ACVE treats the project settings file as repository-controlled, but does not assert that its contents are malicious.

How ACVE detects it

ACVE reads settingsFiles[].scope, settingsFiles[].keys, harness.version, permissionMode, and harness.id. It does not read the value of permissions.defaultMode, determine which setting won precedence, or observe a command being run. The broad version sentinel is a deliberate placeholder while the release range is ungrounded.

Fix

1. Remove the project-level permissions.defaultMode override or change it to an approval-required policy.
2. Set the active permission mode to default or another mode that requires approval.
3. Run grounding and upgrade once the fixed release is confirmed.

Grounding needed

acve advisory ground must confirm the affected Claude Code range and fixed release for GHSA-mmgp-wc2j-qcv7.

Removing the repository override and changing the effective mode address different layers of configuration, so both should be checked after remediation.

References

See references for primary sources.

Underlying CVEs / aliases

• GHSA-mmgp-wc2j-qcv7

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Remove the project permission override and require approval for tools.

Validation

Grounding

• OSV: found; aliases: CVE-2026-33068, GHSA-mmgp-wc2j-qcv7; checked-at 2026-09-20T02:43:27Z
• NVD: not found; checked-at 2026-09-20T02:43:27Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:27Z

References

ADVISORY

• https://github.com/advisories/GHSA-mmgp-wc2j-qcv7

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=GHSA-mmgp-wc2j-qcv7