{
  "entry": {
    "kind": "vuln",
    "slug": "trustfall-one-click-rce-via-claude-code-trust-dialog-regression",
    "name": "trustfall-one-click-rce-via-claude-code-trust-dialog-regression",
    "vendor": "Claude Code",
    "description": "Adversa AI disclosed TrustFall, a regression in Claude Code's trust dialog combined with a settings-scope inconsistency that lets a cloned repository execute unsandboxed code with minimal interaction, a single keypress locally and zero interaction on CI runners. The confirmed one-click RCE reaches Claude Code, Cursor, Gemini CLI, and GitHub Copilot, underscoring how implicit trust assumptions in agent settings keep resurfacing across vendors.",
    "website": "https://adversa.ai/blog/top-agentic-ai-security-resources-june-2026/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ci",
    "updatedAt": "2026-06-01",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "trustfall-one-click-rce-via-claude-code-trust-dialog-regression",
      "aliases": [
        "ti-033"
      ],
      "title": "TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression",
      "summary": "Adversa AI disclosed TrustFall, a regression in Claude Code's trust dialog combined with a settings-scope inconsistency that lets a cloned repository execute unsandboxed code with minimal interaction, a single keypress locally and zero interaction on CI runners. The confirmed one-click RCE reaches Claude Code, Cursor, Gemini CLI, and GitHub Copilot, underscoring how implicit trust assumptions in agent settings keep resurfacing across vendors.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "ci",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-06-01",
      "modifiedAt": "2026-06-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://adversa.ai/blog/top-agentic-ai-security-resources-june-2026/"
        }
      ],
      "mitigation": "Disable auto-trust of cloned repositories; require explicit per-repo trust. Run agents non-interactively only in sandboxed CI with no host credentials. Update Claude Code to the post-regression release. Audit CI runners for unexpected code execution since late May.",
      "detectedByAnomity": false
    }
  }
}