ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0434

ACVE-2026-0434

Claude Code on macOS, opened on an untrusted repository with its sandbox enabled, ran a repository-controlled command outside the sandbox without a permission prompt.

Exposure

Harness
Claude Code below 2.1.247 on macOS — confirmed, accomplish.ai
Model
any — unconfirmed
Goal
Any task opened in an untrusted repository (goal not stated by the source) — unconfirmed
Tools and settings
The macOS sandboxed shell tool and the harness git path — confirmed, accomplish.ai
Approval
Strict don't-ask mode still allowed the repository-controlled command to run outside the sandbox — confirmed, accomplish.ai
Input controlled by
repo-author
What the agent does
The harness runs a repository-controlled command outside the macOS sandbox.
Harm
arbitrary-command
Reach
The Mac and the logged-in user's files — confirmed, accomplish.ai (the home directory, project files)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
HIGH
Status
Unverified
Kind
Code
Source date
2026-09-11
Modified
2026-09-25
Aliases
No CVE assigned — No CVE was assigned in the public disclosure.
Affected
  • AgentHarness: claude-code — < 2.1.247
Harness/product
claude-code
Classes
sandbox-escape; config-file-injection; CWE-693
Taxonomy
ASI: ASI05; ATLAS: AML.T0105
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

demonstrated

Description

What

Accomplish demonstrated that Claude Code's macOS sandbox covered the Bash tool while the harness's git path remained outside it. An untrusted repository could therefore cause a command to run with the logged-in user's authority even in the strictest permission mode.

Detection

Accomplish includes a proof of concept and reports the fix in Claude Code 2.1.247.

Fix

Upgrade Claude Code to 2.1.247 or later and do not treat the sandbox as a complete boundary for untrusted repositories.

Fix

Upgrade Claude Code to 2.1.247 or later.

  • Upgrade harness:claude-code to 2.1.247. Anthropic fixed the issue in this version according to the report. Owner: operator

Report a problemJSON