Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2025-59536 EUVD-2025-32507GHSA-4fgq-fpq9-mr3g

Claude Code's startup trust dialog could lead to Command Execution attack

Published Oct 3, 2025 · Updated Oct 3, 2025 · Assigned by GitHub_M

Vendor: anthropics Product: claude-code Package: @anthropic-ai/claude-code Ecosystem: npm

Description

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.

Affected products

VendorProductAffectedFixed
anthropics claude-code < 1.0.111 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

  • AetherAI3/AETHER-PROTOCOL-P ★ 1 · Mar 16, 2026

    Working implementation: cryptographically verified short-lived identities for AI decision authentication — CVE-2025-59536 (Patent Pending US 64/006,746)

  • Perufitlife/dotclaude-security ★ 0 · Jun 21, 2026

    Scan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untr…

  • Razi-Interactive/claude-project-scanner ★ 0 · Apr 30, 2026

    Read-only safety scanner for Claude Code projects. Catches CVE-2025-59536, statusLine injection, prompt injection, and more.

  • TreRB/ai-ide-config-guard ★ 0 · Apr 20, 2026

    Scan a repo for AI-IDE config files that can trigger RCE via Claude Code hooks, Cursor rules, MCP auto-registration. Detects CVE-2025-59536, CVE-2026-21852, CVE-2026-30615 + Pillar Rules File Backdoo…

  • NetVanguard-cmd/CVE-2025-59536 ★ 0 · Apr 19, 2026
  • Rohitberiwala/Claude-Code-MCP-Injection-PoC ★ 0 · Mar 10, 2026

    Professional PoC for CVE-2025-59536 and related CVEs. Demonstrates an MCP Tool Confirmation Prompt Misrepresentation in Anthropic Claude_Code leading to arbitrary OS command execution.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @anthropic-ai/claude-code < 1.0.111 1.0.111 GHSA-4fgq-fpq9-mr3g

References