Claude Code, an agentic coding tool, has a flaw that allows a malicious repository to bypass the workspace trust confirmation dialog. Prior to version 2.1.53, the tool reads permission settings from a repo‑controlled file (.claude/settings.json) before showing the confirmation prompt. An attacker can set permissions.defaultMode to bypassPermissions, causing the dialog to be skipped automatically, placing a user into a permissive mode without explicit warning and enabling code execution within the tool. This weakness corresponds to CWE‑807, which involves indirect information leakage through misconfigured permissions.

Anthropics’ Claude Code is affected, specifically all releases prior to version 2.1.53, regardless of the underlying operating system. Users running any of those vulnerable releases that open untrusted repositories are at risk.

The CVSS v3 score of 7.7 indicates high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently infrequent. The vulnerability is not listed in CISA’s known exploited vulnerabilities catalog. Exploitability requires an attacker to host a malicious repository that contains a crafted .claude/settings.json file; the attacker needs only repository access and the user must open that repository in Claude Code. No further user interaction beyond opening the repo is required, and the bypass occurs silently, making the risk significant for users who do not verify repository trust.