{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0004",
  "aliases": [
    "CVE-2025-54794"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Claude Code can traverse paths through untrusted context",
  "details": "## What the vulnerability is\n\nClaude Code before `0.2.111` had a path-validation weakness in its project boundary. Prefix-style path checks could treat a path outside the current working directory as allowed when an attacker could arrange a matching prefix and place untrusted content into the context. The result can be unauthorized file access outside the intended project directory.\n\n## Which configuration is exposed\n\nThe exposed combination is Claude Code `<0.2.111`, at least one configured MCP server with a transport, and a permission mode of `auto`, `acceptEdits`, or `bypassPermissions`. These are exactly the matcher conditions: `harness.id` is `claude-code`, `harness.version` is below `0.2.111`, `mcpServers[].transport` exists, and `permissionMode` is one of the three values. The finding does not assert that a particular server is malicious; it identifies a harness and context path in which untrusted input can matter.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, `mcpServers[].transport`, and `permissionMode`. It cannot see whether a transport actually delivered attacker-controlled content, whether a prefix-collision directory exists, or which files would be reachable. A match is therefore a configuration-aware exposure signal, not a reproduction of the traversal.\n\n## Fix\n\n1. Upgrade Claude Code to `0.2.111` or later.\n2. Use an approval-required permission mode while reviewing MCP context, and only enable less restrictive modes for trusted projects.\n\nThe permission-mode condition describes the approval posture at scan time; it does not claim that every configured transport is externally reachable.\n\nThe permission-mode condition describes the approval posture at scan time; it does not claim that every configured transport is externally reachable.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.111"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54794"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-54794"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "path-traversal"
      ],
      "cwe": [
        "CWE-22"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "all": [
              {
                "field": "harness.id",
                "op": "eq",
                "value": "claude-code"
              },
              {
                "field": "harness.version",
                "op": "semverRange",
                "value": "<0.2.111"
              }
            ]
          },
          {
            "some": "mcpServers",
            "where": {
              "field": "transport",
              "op": "exists"
            }
          },
          {
            "field": "permissionMode",
            "op": "in",
            "value": [
              "auto",
              "acceptEdits",
              "bypassPermissions"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Claude Code and require approval when untrusted MCP context is present.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code",
            "to": "0.2.111",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "why": "Do not allow untrusted content to reach the context automatically."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "found": true,
          "cvss": 9.1,
          "published": "2025-08-05T01:15:41.877"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://nvd.nist.gov/vuln/detail/CVE-2025-54794",
          "note": "Claude Code < 0.2.111 path traversal (prefix match); NVD CVSS 9.1."
        }
      ]
    }
  }
}