ACVE-2026-0004

The configuration

Configuration label

claude-code <999.0.0

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0; fixed 2.1.7)

Matcher

• all
  • harness.id eq "claude-code"
  • harness.version semverRange "<999.0.0"
  • deniedTools exists

Why it is exploitable

What the vulnerability is

Claude Code deny rules can be bypassed when a tool is reached through a symlinked path and the harness does not compare the canonical target as intended. The current reference set does not establish the complete bypass mechanics or a fixed release, so this record remains a configuration review signal.

Which configuration is exposed

The matcher requires harness.id claude-code, a version below <999.0.0>, and the presence of the deniedTools field. It does not test whether the list is non-empty, which tool is denied, whether a symlink exists, or whether the path resolves outside the expected location. The finding therefore covers any lockfile that records deny rules and needs a path-level review.

How ACVE detects it

ACVE reads harness.id, harness.version, and the existence of deniedTools. It cannot inspect canonical paths, symlink targets, tool aliases, the deny-list contents, or an attempted bypass. The broad version condition is deliberately retained until the advisory is grounded.

Fix

1. Review deniedTools and prefer an explicit allowlist for sensitive tools.
2. Verify that every tool path is canonicalized before the deny decision and remove symlinked paths that are not required.
3. Run grounding and upgrade to the confirmed fixed release when one is established.

Grounding needed

acve advisory ground must confirm the affected Claude Code range, fixed release, and the exact symlink bypass behavior for GHSA-4q92-rfm6-2cqx.

Canonical-path review is a compensating control only; it does not establish that the ungrounded advisory has a particular fixed version.

References

See references for primary sources.

Underlying CVEs / aliases

• GHSA-4q92-rfm6-2cqx

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Review deny rules and canonicalize tool paths before relying on them.

Validation

Grounding

• OSV: found; aliases: CVE-2026-25724, GHSA-4q92-rfm6-2cqx; checked-at 2026-09-20T02:43:27Z
• NVD: not found; checked-at 2026-09-20T02:43:27Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:27Z

References

ADVISORY

• https://github.com/advisories/GHSA-4q92-rfm6-2cqx

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=GHSA-4q92-rfm6-2cqx