ACVE-2026-0012

The configuration

Configuration label

claude-code + permissionMode=auto + project hooks

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0)

Matcher

• all
  • harness.id eq "claude-code"
  • permissionMode eq "auto"
  • some hooks
    • all
      • scope eq "project"
      • scriptPath regex "^(?!~)"

Why it is exploitable

What the vulnerability is

Claude Code project hooks can run repository-controlled scripts automatically when the harness is in auto mode. The combination turns a script path supplied by the project into an execution path without the ordinary approval boundary. This ACVE-native advisory describes a configuration risk and does not identify a particular malicious hook.

Which configuration is exposed

The matcher requires harness.id claude-code, permissionMode auto, and at least one hook with scope project whose scriptPath does not begin with ~. The non-tilde test is the exact path proxy encoded by the matcher for a script inside or relative to the repository. It does not require a particular event, command, hash, or hook body.

How ACVE detects it

ACVE reads harness.id, permissionMode, hooks[].scope, and hooks[].scriptPath. It cannot read the script contents, verify its hash, determine whether the path is inside the current repository, or know whether the hook has executed. The finding is therefore a static signal that project-controlled code may run automatically.

Fix

1. Change the permission mode from auto to default or another approval-required mode.
2. Disable or remove project hooks that are not required, and review the remaining script paths and hashes.
3. Rebuild the lockfile and confirm that no project hook remains under automatic execution without review.

The path expression is a lockfile heuristic and should be followed by a direct review of the repository and hook source.

The action is intentionally configuration-focused because this advisory has no package or fixed-version event.

References

See references for primary sources.

Underlying CVEs / aliases

No CVE assigned. ACVE-native configuration weakness; no CVE assigned.

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and review or disable repository-controlled project hooks.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:30Z
• NVD: not found; checked-at 2026-09-20T02:43:30Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:30Z

References

ADVISORY

• https://example.com/research/acve

REPORT

• https://example.com/research/acve