AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AnthropicGHSA-4fgq-fpq9-mr3g

Command execution prior to Claude Code startup trust dialog

Anthropic

CVE-2025-59536 · Published Oct 3, 2025

High8.7
Fix: upgrade to v1.0.111 or later
GitHub advisory

Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.

Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.

Thank you to https://hackerone.com/avivdon for reporting this issue!

Affected versions

PackageAffectedFixed in
@anthropic-ai/claude-code
npm
< v1.0.111v1.0.111
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94

More Anthropic advisories

All Anthropic
High 7.7Nov 19, 2025Command execution prior to Claude Code startup trust dialogCVE-2025-65099fixed in v1.0.39Low 2.3Oct 3, 2025Permission deny bypass through symlinkCVE-2025-59829fixed in v1.0.120High 7.7Sep 24, 2025Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsCVE-2025-59828fixed in v1.0.39High 8.7Sep 9, 2025Command Injection in Claude Code rg command allowed bypass of user approval prompt for command executionCVE-2025-58764fixed in 1.0.105High 8.7Sep 9, 2025Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailCVE-2025-59041fixed in 1.0.105High 8.7Sep 2, 2025Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup WarningGHSA-ph6w-f82w-28w6fixed in v1.0.87