{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0005",
  "aliases": [
    "CVE-2025-54795"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Claude Code can execute commands under permissive approval modes",
  "details": "## What the vulnerability is\n\nClaude Code can execute commands under permissive approval modes when a vulnerable release handles tool requests without preserving the intended approval boundary. The affected harness range in this record is before `1.0.20`. The security consequence is command execution with the permissions of the Claude Code process when an unsafe tool request reaches the command path.\n\n## Which configuration is exposed\n\nThe exposed combination is Claude Code with `harness.id` `claude-code`, a version below `1.0.20`, and `permissionMode` set to `auto`, `acceptEdits`, or `bypassPermissions`. Those three values are the complete mode list encoded by the matcher. A default, plan, or other approval-requiring mode does not match this rule. The matcher does not identify a specific command, project, prompt, or MCP server, so a match is a broad approval-boundary warning.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and `permissionMode` from the lockfile. It cannot see the exact tool request, whether a user would have approved it, or whether the process is operating in a trusted repository. The fixed boundary is treated here as `1.0.20` (unverified — see Grounding needed), so the finding should be rechecked against the referenced advisory before relying on the version comparison.\n\n## Fix\n\n1. Upgrade Claude Code to `1.0.20` or later after confirming the fixed release.\n2. Replace `auto`, `acceptEdits`, or `bypassPermissions` with an approval-required mode until the upgrade is complete.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected range, the fixed Claude Code release, and that the `CVE-2025-54795` alias refers to this command-execution issue.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.20"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54795"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-54795"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI02 Tool Misuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<1.0.20"
          },
          {
            "field": "permissionMode",
            "op": "in",
            "value": [
              "auto",
              "acceptEdits",
              "bypassPermissions"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Claude Code to the confirmed fixed release and require command approval.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code",
            "to": "1.0.20",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "found": true,
          "cvss": 9.8,
          "published": "2025-08-05T01:15:42.023"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:23Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}