Disclosed weakness · no CVE recorded

Changing directories could leave project files outside Claude Code’s permission rules

Anthropic · Claude Code · Project file permission rules

First documented disclosure · Review checkpoint

Summary

Relative deny and ask rules could stop covering the project after the working directory changed.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The vendor release notes report a fix and identify no exploitation against users.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Relative deny and ask rules could stop covering the project after the working directory changed.

Conditions required

A session changes directory and relies on rules expressed relative to the project.

Potential impact

Project files expected to require approval or be denied could fall outside those rules.

Affected versions and configurations

Anthropic did not publish the earliest affected version.

Fix and mitigation status

Anthropic lists the correction in 2.1.325.

Practical next steps

Update Claude Code to a supported release containing the 2.1.325 correction.

Operating lesson

Test project-relative permissions from each working directory available to the agent.

Evidence and limits

The November 13 release provides no issue-specific CVE or severity. Its change to the default approval flow for sandboxed Bash is documented separately.

Sources