Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins and yarnPath could be executed prior to the user accepting the risks of working in an untruste...

GHSA-2JJV-QF24-VFM4 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins and yarnPath could be executed prior to the user accepting the risks of working in an untruste...

PT-2025-39338

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.39 Description Claude Code is an agentic coding tool. When used with Yarn versions 2.0 and higher, Yarn plugins are automatically executed when running yarn --version in versions prior to 1.0.39. This could...

Claude Code security vulnerabilities

Claude Code is an open source proxy coding tool from Anthropic. A security vulnerability exists in versions prior to Claude Code 1.0.39, which stems from the Yarn plugin auto-execution and could lead to bypassing the directory trust dialog...

CVE-2025-59828: Inclusion of Functionality from Untrusted Control Sphere

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-58764

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

CVE-2025-59041

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with git config user.email. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. User...

@tessl/cli (>=0.21.0, <=0.21.2), @zed-industries/claude-code-acp (0.1.7) +8 more potentially affected by CVE-2025-59041 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.98)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-59041 Source advisory: GHSA-J4H9-WV2M-WRF7...

@tessl/cli (>=0.21.0, <=0.21.2), @zed-industries/claude-code-acp (0.1.7) +8 more potentially affected by CVE-2025-59041 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.98)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-59041 Source advisory: OSV:GHSA-J4H9-WV2M-WRF7...

@tessl/cli (>=0.21.0, <=0.21.2), @zed-industries/claude-code-acp (0.1.7) +8 more potentially affected by CVE-2025-58764 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.98)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-58764 Source advisory: GHSA-QXFV-FCPC-W36X...

@tessl/cli (>=0.21.0, <=0.21.2), @zed-industries/claude-code-acp (0.1.7) +8 more potentially affected by CVE-2025-58764 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.98)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-58764 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-12705383...

@tessl/cli (>=0.21.0, <=0.21.2), @zed-industries/claude-code-acp (0.1.7) +8 more potentially affected by CVE-2025-58764 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.98)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-58764 Source advisory: OSV:GHSA-QXFV-FCPC-W36X...

Arbitrary Code Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Code Injection via th...

GHSA-QXFV-FCPC-W36X Claude Code rg vulnerability does not protect against approval prompt bypass

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will...

Claude Code rg vulnerability does not protect against approval prompt bypass

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will...

CVE-2025-59041

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with git config user.email. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. User...

CVE-2025-58764

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

CVE-2025-59041 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with git config user.email. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. User...

@4via6/relay (>=1.0.0, <=1.1.3), @axonpush/wizard (>=0.0.1, <=0.0.4) +12 more potentially affected by CVE-2025-59041 via @anthropic-ai/claude-code (>=0.2.14, <=1.0.98)

@anthropic-ai/claude-code NPM version =0.2.14, =1.0.0, =0.0.1, =0.21.0, =0.2.0, =1.8.0, =0.1.34, =1.4.0, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-59041 Source advisory: MEND:CVE-2025-59041...

CVE-2025-59041

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with "git config user.email". Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog...