{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0003",
  "aliases": [
    "GHSA-mmgp-wc2j-qcv7"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Claude Code project permissions can select an unsafe permission mode",
  "details": "## What the vulnerability is\n\nClaude Code project permissions can select an unsafe permission mode from repository-controlled settings. The specific combination in this advisory is a project setting containing `permissions.defaultMode` while the active harness mode is `bypassPermissions`. That combination can remove the approval boundary that would otherwise mediate tool or command execution.\n\n## Which configuration is exposed\n\nThe matcher requires a project-scoped settings file whose `keys` contains `permissions.defaultMode`, a Claude Code harness, a version below `<999.0.0>`, and `permissionMode` equal to `bypassPermissions`. Every condition is encoded; a user-scoped setting, a different permission mode, or a file without that key does not match this rule. ACVE treats the project settings file as repository-controlled, but does not assert that its contents are malicious.\n\n## How ACVE detects it\n\nACVE reads `settingsFiles[].scope`, `settingsFiles[].keys`, `harness.version`, `permissionMode`, and `harness.id`. It does not read the value of `permissions.defaultMode`, determine which setting won precedence, or observe a command being run. The broad version sentinel is a deliberate placeholder while the release range is ungrounded.\n\n## Fix\n\n1. Remove the project-level `permissions.defaultMode` override or change it to an approval-required policy.\n2. Set the active permission mode to `default` or another mode that requires approval.\n3. Run grounding and upgrade once the fixed release is confirmed.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected Claude Code range and fixed release for `GHSA-mmgp-wc2j-qcv7`.\n\nRemoving the repository override and changing the effective mode address different layers of configuration, so both should be checked after remediation.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.53"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mmgp-wc2j-qcv7"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=GHSA-mmgp-wc2j-qcv7"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "unsafe-permission-mode"
      ],
      "cwe": [
        "CWE-732"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI03 Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "some": "settingsFiles",
            "where": {
              "all": [
                {
                  "field": "scope",
                  "op": "eq",
                  "value": "project"
                },
                {
                  "field": "keys",
                  "op": "contains",
                  "value": "permissions.defaultMode"
                }
              ]
            }
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<999.0.0"
          },
          {
            "field": "permissionMode",
            "op": "eq",
            "value": "bypassPermissions"
          },
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          }
        ]
      },
      "fix": {
        "summary": "Remove the project permission override and require approval for tools.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code",
            "to": "2.1.53",
            "why": "Vendor fix confirmed via OSV."
          },
          {
            "type": "reconfigure",
            "target": "settings:claude-code:permissions.defaultMode",
            "to": "unset",
            "why": "Repository settings must not silently select the permission policy."
          },
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "to": "default",
            "why": "Repository settings must not silently disable approvals."
          }
        ]
      },
      "exposure": "repo-controlled",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2026-33068",
            "GHSA-mmgp-wc2j-qcv7"
          ],
          "packagesConfirmed": [
            {
              "ecosystem": "npm",
              "name": "@anthropic-ai/claude-code"
            }
          ],
          "fixedVersionsConfirmed": [
            "2.1.53"
          ],
          "cvss": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7",
          "note": "Fixed version 2.1.53 confirmed by OSV grounding."
        }
      ]
    }
  }
}