GHSA-mmgp-wc2j-qcv7 (Penligent)

Description

Vulnerability documented by Penligent: Claude Code resolves permission mode from settings files including repo-controlled ones, enabling a directory-change-based bypass of protected writes. Same architectural failure pattern as CVE-2025-59536 — repo-controlled configuration takes effect before trust is established.

Key claims

Relations

Sources

src-20260419-16b155f4f619