{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0004",
  "aliases": [
    "GHSA-4q92-rfm6-2cqx"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Claude Code deny rules can be bypassed through symlinked tools",
  "details": "## What the vulnerability is\n\nClaude Code deny rules can be bypassed when a tool is reached through a symlinked path and the harness does not compare the canonical target as intended. The current reference set does not establish the complete bypass mechanics or a fixed release, so this record remains a configuration review signal.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `claude-code`, a version below `<999.0.0>`, and the presence of the `deniedTools` field. It does not test whether the list is non-empty, which tool is denied, whether a symlink exists, or whether the path resolves outside the expected location. The finding therefore covers any lockfile that records deny rules and needs a path-level review.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and the existence of `deniedTools`. It cannot inspect canonical paths, symlink targets, tool aliases, the deny-list contents, or an attempted bypass. The broad version condition is deliberately retained until the advisory is grounded.\n\n## Fix\n\n1. Review `deniedTools` and prefer an explicit allowlist for sensitive tools.\n2. Verify that every tool path is canonicalized before the deny decision and remove symlinked paths that are not required.\n3. Run grounding and upgrade to the confirmed fixed release when one is established.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected Claude Code range, fixed release, and the exact symlink bypass behavior for `GHSA-4q92-rfm6-2cqx`.\n\nCanonical-path review is a compensating control only; it does not establish that the ungrounded advisory has a particular fixed version.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4q92-rfm6-2cqx"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=GHSA-4q92-rfm6-2cqx"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "auth-bypass"
      ],
      "cwe": [
        "CWE-59"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI03 Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<999.0.0"
          },
          {
            "field": "deniedTools",
            "op": "exists"
          }
        ]
      },
      "fix": {
        "summary": "Review deny rules and canonicalize tool paths before relying on them.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code",
            "to": "2.1.7",
            "why": "Vendor fix confirmed via OSV."
          },
          {
            "type": "reconfigure",
            "target": "settings:claude-code:deniedTools",
            "to": "reviewed-allowlist",
            "why": "Use allowlists and verify canonical paths."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2026-25724",
            "GHSA-4q92-rfm6-2cqx"
          ],
          "packagesConfirmed": [
            {
              "ecosystem": "npm",
              "name": "@anthropic-ai/claude-code"
            }
          ],
          "fixedVersionsConfirmed": [
            "2.1.7"
          ],
          "cvss": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4q92-rfm6-2cqx",
          "note": "Fixed version 2.1.7 confirmed by OSV grounding."
        }
      ]
    }
  }
}