ACVE-2025-0011

The configuration

Configuration label

claude-code <1.0.24

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0; fixed 1.0.24)

Matcher

• all
  • harness.id eq "claude-code"
  • harness.version semverRange "<1.0.24"

Why it is exploitable

What the vulnerability is

The Claude Code IDE extension can bypass the local authentication boundary described by its advisory. The affected component is the extension integration, while the ACVE record uses the Claude Code harness identity as its versioned proxy. This record treats versions before 1.0.24 as exposed.

Which configuration is exposed

The matcher exposes a Claude Code harness with harness.id claude-code and harness.version below 1.0.24. It does not require an MCP server, a project file, a permission mode, or an explicit IDE field. That is intentional: the lock schema can record the harness version but does not independently establish that the IDE extension is installed or connected.

How ACVE detects it

ACVE reads only harness.id and harness.version for this advisory. It cannot tell whether the process is running under the IDE extension, whether local authentication was attempted, or whether a request crossed the affected boundary. A finding is therefore a version-proxy signal and should be confirmed against the extension installation.

Fix

1. Upgrade the Claude Code IDE extension to 1.0.24 or later after confirming the extension's fixed release.
2. Until then, do not rely on the extension's local authentication boundary for sensitive operations; use a trusted local session and limit exposure of the integration.

The upgrade target is intentionally expressed as an extension harness target even though the matcher records the parent Claude Code identity.

Grounding needed

acve advisory ground must confirm the IDE extension package identity, its affected range, and its fixed release, and must confirm that CVE-2025-52882 is the alias for this issue.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-52882

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade the Claude Code IDE extension to the confirmed fixed release.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:26Z
• NVD: not found; checked-at 2026-09-20T02:43:26Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:26Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-52882

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-52882