{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0011",
  "aliases": [
    "CVE-2025-52882"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Claude Code IDE extension can bypass local authentication",
  "details": "## What the vulnerability is\n\nThe Claude Code IDE extension can bypass the local authentication boundary described by its advisory. The affected component is the extension integration, while the ACVE record uses the Claude Code harness identity as its versioned proxy. This record treats versions before `1.0.24` as exposed.\n\n## Which configuration is exposed\n\nThe matcher exposes a Claude Code harness with `harness.id` `claude-code` and `harness.version` below `1.0.24`. It does not require an MCP server, a project file, a permission mode, or an explicit IDE field. That is intentional: the lock schema can record the harness version but does not independently establish that the IDE extension is installed or connected.\n\n## How ACVE detects it\n\nACVE reads only `harness.id` and `harness.version` for this advisory. It cannot tell whether the process is running under the IDE extension, whether local authentication was attempted, or whether a request crossed the affected boundary. A finding is therefore a version-proxy signal and should be confirmed against the extension installation.\n\n## Fix\n\n1. Upgrade the Claude Code IDE extension to `1.0.24` or later after confirming the extension's fixed release.\n2. Until then, do not rely on the extension's local authentication boundary for sensitive operations; use a trusted local session and limit exposure of the integration.\n\nThe upgrade target is intentionally expressed as an extension harness target even though the matcher records the parent Claude Code identity.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the IDE extension package identity, its affected range, and its fixed release, and must confirm that `CVE-2025-52882` is the alias for this issue.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.24"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52882"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-52882"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "auth-bypass"
      ],
      "cwe": [
        "CWE-306"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI03 Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<1.0.24"
          }
        ]
      },
      "fix": {
        "summary": "Upgrade the Claude Code IDE extension to the confirmed fixed release.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code-ide-extension",
            "to": "1.0.24",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}