CVE-2026-33068 is a trust dialog bypass vulnerability in Anthropic Claude Code, an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repository-controlled .claude/settings.json , before determining whether to display the workspace trust confirmation dialog. A malicious repository could set permissions.defaultMode to bypassPermissions in its committed .claude/settings.json file, causing the trust dialog to be silently skipped on first open. This allowed a user to be placed into a permissive mode without seeing the trust confirmation prompt, making it easier for an attacker-controlled repository to gain tool execution without explicit user consent.
An attacker could craft a malicious repository that bypasses the workspace trust confirmation dialog, allowing arbitrary tool execution without explicit user consent when a victim clones and opens the repository in Claude Code.
This vulnerability is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The core issue stems from Claude Code's permission system processing order, where repository-controlled settings files are evaluated before the workspace trust mechanism can properly gate access. When a user opens a repository for the first time, Claude Code is designed to present a trust confirmation dialog that asks users to explicitly approve whether they trust the repository and want to grant it elevated permissions.
However, the vulnerability allows a malicious repository to include a pre-configured .claude/settings.json file that sets permissions.defaultMode to bypassPermissions . Because the settings file is processed before the trust dialog logic is invoked, the application determines that permissions have already been configured and skips the trust prompt entirely.
The attack requires user interaction—specifically, the victim must clone and open the malicious repository in Claude Code. However, no further consent is required once the repository is opened, as the trust dialog that would normally require explicit approval is silently bypassed.
The root cause is the improper ordering of security-critical operations in Claude Code's initialization sequence. The permission mode resolution from settings files occurs before the workspace trust evaluation, allowing repository-controlled configuration to influence security decisions that should require explicit user consent. This represents a reliance on untrusted inputs (the repository's .claude/settings.json ) for making security-critical decisions permission granting.
The attack vector for CVE-2026-33068 is network-based, requiring an attacker to distribute a malicious repository containing a crafted .claude/settings.json configuration file. The attack scenario involves:
The vulnerability enables potential arbitrary code execution through Claude Code's agentic capabilities, as the tool execution consent mechanism is effectively bypassed.
Anthropic has addressed this vulnerability in Claude Code version 2.1.53 . The fix ensures that the workspace trust confirmation dialog is displayed before processing permission settings from repository-controlled configuration files. Users should update to version 2.1.53 or later to remediate this vulnerability. For detailed information, refer to the GitHub Security Advisory GHSA-mmgp-wc2j-qcv7 .
Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
