{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0012",
  "aliases": [],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Claude Code project hooks run automatically inside the repository",
  "details": "## What the vulnerability is\n\nClaude Code project hooks can run repository-controlled scripts automatically when the harness is in `auto` mode. The combination turns a script path supplied by the project into an execution path without the ordinary approval boundary. This ACVE-native advisory describes a configuration risk and does not identify a particular malicious hook.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `claude-code`, `permissionMode` `auto`, and at least one hook with `scope` `project` whose `scriptPath` does not begin with `~`. The non-tilde test is the exact path proxy encoded by the matcher for a script inside or relative to the repository. It does not require a particular event, command, hash, or hook body.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `permissionMode`, `hooks[].scope`, and `hooks[].scriptPath`. It cannot read the script contents, verify its hash, determine whether the path is inside the current repository, or know whether the hook has executed. The finding is therefore a static signal that project-controlled code may run automatically.\n\n## Fix\n\n1. Change the permission mode from `auto` to `default` or another approval-required mode.\n2. Disable or remove project hooks that are not required, and review the remaining script paths and hashes.\n3. Rebuild the lockfile and confirm that no project hook remains under automatic execution without review.\n\nThe path expression is a lockfile heuristic and should be followed by a direct review of the repository and hook source.\n\nThe action is intentionally configuration-focused because this advisory has no package or fixed-version event.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "exposure": "local",
      "vulnClasses": [
        "hook-injection"
      ],
      "cwe": [
        "CWE-94"
      ],
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "permissionMode",
            "op": "eq",
            "value": "auto"
          },
          {
            "some": "hooks",
            "where": {
              "all": [
                {
                  "field": "scope",
                  "op": "eq",
                  "value": "project"
                },
                {
                  "field": "scriptPath",
                  "op": "regex",
                  "value": "^(?!~)"
                }
              ]
            }
          }
        ]
      },
      "fix": {
        "summary": "Require approval and review or disable repository-controlled project hooks.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "to": "default",
            "why": "Prevent project hooks from running automatically."
          },
          {
            "type": "reconfigure",
            "target": "settings:claude-code:hooks.project",
            "to": "reviewed-only",
            "why": "Require review before repository-controlled hook scripts are enabled."
          }
        ]
      },
      "noCveReason": "ACVE-native configuration weakness; no CVE assigned.",
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}