Disclosed weakness · no CVE recorded

Claude Code’s Bash rules could miss actions that required approval

Anthropic · Claude Code Bash permission checks

First documented disclosure · Review checkpoint

Summary

Anthropic lists several cases where the Bash tool did not apply the expected user permission check. The fixes cover command interpretation and automatic editing modes.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Vendor-reported permission weakness; the reviewed evidence does not identify malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The policy check could interpret an operation differently from the shell or skip an expected review in automatic editing modes.

Conditions required

A session using the Bash tool and the affected approval settings. Some cases concern deny or ask rules; another concerns the accept-edits and auto modes.

Potential impact

Part of an operation could avoid its expected permission check. The vendor did not report affected users or a specific downstream effect.

Affected versions and configurations

Earlier affected versions were not enumerated.

Fix and mitigation status

Anthropic lists the fix in Claude Code 2.1.319.

Practical next steps

Use a maintained release with the fix, and keep approval and execution under the same policy on developer machines and CI runners.

Operating lesson

A command approval should cover the entire operation the runtime will execute.

Evidence and limits

This record groups related approval fixes separately enumerated in the November 6 release. The release does not establish that they share a root cause, a CVE or a severity score. The worktree sandbox correction is recorded separately.

Sources