CVE-2026-33068: Bypass of Workspace Trust Dialog in @anthropic-ai/claude-code
Summary
CVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File. Affects @anthropic-ai/claude-code versions < 2.1.53. Fixed in 2.1.53. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is an open-source code editor developed by Anthropic AI, designed to enhance coding efficiency and collaboration. It features workspace management, syntax highlighting, and integration with various programming tools. However, a recent vulnerability has been identified that compromises its workspace trust mechanism, potentially allowing malicious repositories to execute code without user consent.
Vulnerability Detail
The vulnerability arises from the way Claude Code processes settings files, particularly the repo-controlled '.claude/settings.json'. The application resolves the permission mode from these settings files before displaying the workspace trust confirmation dialog. An attacker can exploit this by committing a settings file with 'permissions.defaultMode' set to 'bypassPermissions', which allows the trust dialog to be skipped. This can lead to unauthorized tool execution, putting users at risk of executing malicious code without their explicit consent.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.53
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.1.53Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The CVE-2026-33068 vulnerability in the @anthropic-ai/claude-code package poses a significant risk by allowing a bypass of the workspace trust dialog. Users are strongly advised to update to version 2.1.53 or later to protect against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2026-33068 is a vulnerability in the @anthropic-ai/claude-code package that allows a bypass of the workspace trust dialog, potentially enabling unauthorized code execution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk of exploitation.
If exploited, this vulnerability could allow attackers to execute arbitrary code in the user's environment without their consent, leading to data breaches or system compromise.
The CVSS score for this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
