// ClaudeMEDIUM
Anthropic Claude Code CLI (versions prior to 2.0.65) contains a pre-trust execution vulnerability (CVE-2026-21852, CVSS 5.3) where project-level configuration files (.claude/settings.json) are evaluated before interactive trust confirmation. Attackers can craft weaponized repositories that redirect API requests to attacker-controlled domains, exfiltrate live Anthropic API keys, and execute arbitrary code via lifecycle hooks or git metadata exploitation before the user approves execution.
// Get alerts for Claude