481 matches found
CVE-2025-65099
CVE-2025-65099 – Claude Code pre‑startup trust bypass via Yarn 3.x plugins is raised for Claude Code prior to 1.0.39. The issue allowed code execution from a project directory by exploiting Yarn 3.0+ plugins before the startup trust dialog was accepted. Affected scenario required running Claude C...
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
PT-2025-47513
Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.39 Description Prior to version 1.0.39, Claude Code could be tricked into executing code contained in a project through Yarn plugins before the user accepted the startup trust dialog, when running on a machine...
Claude Code 代码注入漏洞
Claude Code is an open source proxy coding tool from Anthropic. A code injection vulnerability exists in Claude Code versions prior to 1.0.39, which stems from the possibility of executing project code via the yarn plugin without the user having to accept the startup trust dialog in Yarn 3.0 and...
CVE-2025-65099: Improper Control of Generation of Code
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
Arbitrary Code Execution
@anthropic-ai/claude-code is vulnerable to Arbitrary Code Execution. The vulnerability is due to the automatic execution of Yarn plugins when running yarn --version, which allows an attacker to bypass the directory trust dialog and execute code before the user confirms trust in the directory...
EUVD-2025-36793
Malicious code in @gitlab-test/yarn-v4 npm...
Malicious Package
Overview @gitlab-test/yarn-v4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2025-48968 Malicious code in @gitlab-test/yarn-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f274342e8c6f4a200134b68b571eb1eb5d9f01c5d28f5d445b0da3fff6808ff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @gitlab-test/yarn-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f274342e8c6f4a200134b68b571eb1eb5d9f01c5d28f5d445b0da3fff6808ff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
[SECURITY] Fedora 43 Update: yarnpkg-1.22.22-12.fc43
Fast, reliable, and secure dependency management...
[SECURITY] Fedora 42 Update: yarnpkg-1.22.22-12.fc42
Fast, reliable, and secure dependency management...
EUVD-2019-0447
Malware in sbrugna...
EUVD-2018-0806
Malware in sbrugna...
EUVD-2018-0816
Malware in sbrugna...
EUVD-2020-0291
Malware in sbrugna...
EUVD-2019-0608
Malware in sbrugna...