{
  "entry": {
    "kind": "vuln",
    "slug": "claude-code-silently-patched-five-permission-and-hook-bypasses-across-2",
    "name": "claude-code-silently-patched-five-permission-and-hook-bypasses-across-2",
    "vendor": "Claude Code",
    "description": "Five releases between 20 July and 4 August each fixed a security-relevant bypass, recorded only as changelog bullets with no advisory or CVE: Bash permission checking missed compound statements with redirects (2.1.216), background-session isolation failed to canonicalize symlinked directories (2.1.217), agent frontmatter hooks executed from untrusted folders (2.1.218), a Bash permission check could be bypassed with zsh regex conditionals (2.1.221), and a PreToolUse auto-allow hook bypass plus a worktree-isolation escape (2.1.222). 2.1.219 also added sandbox.network.strictAllowlist. Because none of these carry an advisory, version currency is the only signal a fleet has.",
    "website": "https://github.com/anthropics/claude-code/releases",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-04",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "claude-code-silently-patched-five-permission-and-hook-bypasses-across-2",
      "aliases": [
        "ti-069"
      ],
      "title": "Claude Code Silently Patched Five Permission and Hook Bypasses Across 2.1.216 to 2.1.222",
      "summary": "Five releases between 20 July and 4 August each fixed a security-relevant bypass, recorded only as changelog bullets with no advisory or CVE: Bash permission checking missed compound statements with redirects (2.1.216), background-session isolation failed to canonicalize symlinked directories (2.1.217), agent frontmatter hooks executed from untrusted folders (2.1.218), a Bash permission check could be bypassed with zsh regex conditionals (2.1.221), and a PreToolUse auto-allow hook bypass plus a worktree-isolation escape (2.1.222). 2.1.219 also added sandbox.network.strictAllowlist. Because none of these carry an advisory, version currency is the only signal a fleet has.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Privilege escalation",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code < 2.1.222",
          "fixed": "2.1.222"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-04",
      "modifiedAt": "2026-08-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://github.com/anthropics/claude-code/releases"
        }
      ],
      "mitigation": "Upgrade Claude Code to 2.1.222 or later and enforce a minimum version across the fleet. These fixes ship without advisories, so a tool_version policy is the practical control: an out-of-date agent here means live permission bypasses, not just missing features.",
      "detectedByAnomity": true
    }
  }
}