Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying t
Timeline
29 Sep- Published by GitHub advisory29 Sep
- Seen by Patchwire23 Oct
- Fix released29 Sep
Versions of @anthropic-ai/claude-code
Packages
Stacks
Related alerts(2)
Same packagesSource summary
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin so
- Affected
- @anthropic-ai/claude-code <2.1.179
- Fixed in
- 2.1.179
- ID
- GHSA-pq7j-f95f-qfcv
Source summary
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lowe
- Affected
- @anthropic-ai/claude-code <2.1.129
- Fixed in
- 2.1.129
- ID
- GHSA-5j29-h97v-84ch