CVE-2025-59536
Claude Code's startup trust dialog could lead to Command Execution attack
Description
Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.
INFO
Published Date :
Oct. 3, 2025, 7:15 a.m.
Last Modified :
June 17, 2026, 9:46 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-59536
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Claude Code to the latest version.
- Ensure projects are started in trusted directories.
Public PoC/Exploit Available at Github
CVE-2025-59536 has a 125 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-59536.
| URL | Resource |
|---|---|
| https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-59536 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-59536
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Security-audit your entire Claude Code setup in one command. Scans skills, agents, hooks, permissions, and MCP configs for prompt-injection, supply-chain, and secret-exposure risks. Zero dependencies.
agent-security ai-agents ai-security anthropic claude claude-code cli developer-tools devsecops llm mcp mcp-security prompt-injection sast secrets-detection security-scanner security-tools static-analysis supply-chain-security typescript
TypeScript JavaScript
A Linux host security scanner with a native CLI and desktop GUI — SSH/kernel/systemd hardening checks, real ClamAV scanning, file-integrity monitoring, and continuous background monitoring.
clamav cli desktop-app hardening infosec linux rust security security-scanner security-tools sysadmin tauri
HTML Rust TypeScript CSS Shell JavaScript Dockerfile Python Makefile
None
Dockerfile Python Shell
Open-source security scanner for MCP servers and AI agents: finds prompt injection, tool poisoning, and excessive agency, and models the cloud your agents can reach. pip install attestral.
agentic-ai design-review mcp security terraform threat-modeling agentic-security ai-agents ai-security devsecops llm-security mcp-security model-context-protocol prompt-injection
Python HTML HCL
Notari Change Control verifies AI-authored pull requests against a human-signed task boundary and emits a PASS / NEEDS_REVIEW / BLOCK Change Passport for reviewers.
agent-governance ai-agents audit-log change-management ci-cd claude-code code-review cursor python
Shell Python
Static security auditor for Claude Code / MCP config — flags supply-chain, credential, and RCE risk before an agent runs. Offline CLI.
Python
None
HTML Ruby JavaScript Shell
Reusable GitHub Actions security workflows for personal repos
Shell Dockerfile
Protocolo de auditoría de seguridad pre-instalación para skills de Claude Code, MCPs y repos de GitHub
Claude-only agent framework
Shell
Claude Code skill (defensive): vet a third-party SKILL.md, its hooks, and the settings.json hook it would register BEFORE you install. Static scan for injection/exfiltration/dangerous commands; returns an ALLOW/REVIEW/BLOCK verdict with the exact lines to remove.
ai-agents anthropic claude claude-code claude-code-skill defensive security skill static-analysis supply-chain claude-code-plugin
PowerShell Shell JavaScript
Curated security auditors for the backend stack — Supabase, Firebase, Hasura, Strapi, Directus, Payload, Convex, n8n, Ollama & more. Keyless, active-probe, MIT.
awesome awesome-list baas backend devsecops graphql headless-cms security security-audit vulnerability-scanner
Scan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untrusted repository. Static, zero-dep, local-first.
ai-agents claude claude-code cve devsecops mcp rce security static-analysis supply-chain-security
JavaScript
None
Makefile Python C HTML
None
Dockerfile Shell Go
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-59536 vulnerability anywhere in the article.
-
The Hacker News
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and ... Read more
-
TheCyberThrone
Claude Code Security vs. OpenAI Codex Security – AI Arms Race
A Technical Comparison for AppSec Engineers | March 2026TL;DRBoth tools launched within two weeks of each other in early 2026. Both use LLM-driven reasoning to find and patch vulnerabilities beyond wh ... Read more
-
CybersecurityNews
Claude Code Hacked to Achieve Full RCE and Hijacked Organization API keys
Claude Code Hacked RCE Hijacked Organization API keys Critical vulnerabilities in Anthropic’s Claude Code, an AI-powered command-line development tool. The flaws could allow attackers to achieve Remot ... Read more
-
CybersecurityNews
New Claude Code Enables Remote Control of Your Terminal Session From Your Phone
Claude Code Remote Control From Phone Anthropic has launched a new “Remote Control” feature for its agentic terminal tool, Claude Code. His capability allows developers to start tasks in their local t ... Read more
-
CybersecurityNews
Critical Claude Code Vulnerabilities Enables Remote Code Execution Attacks
Claude Code Vulnerabilities A critical security flaw in Anthropic’s Claude Code demonstrates how threat actors can exploit repository configuration files to execute malicious code and steal sensitive ... Read more
-
The Register
Claude collaboration tools left the door wide open to remote code execution
Security vulnerabilities in Claude Code could have allowed attackers to remotely execute code on users' machines and steal API keys by injecting malicious configurations into repositories, and then wa ... Read more
-
The Hacker News
Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration
Cybersecurity researchers have disclosed multiple security vulnerabilities in Anthropic's Claude Code, an artificial intelligence (AI)-powered coding assistant, that could result in remote code execut ... Read more
The following table lists the changes that have been made to the
CVE-2025-59536 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'anthropics', 'product': 'claude-code', 'versions': [{'status': 'affected', 'version': '< 1.0.111'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-59536', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-10-03T13:26:09.204169Z'} -
Initial Analysis by [email protected]
Oct. 23, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:* versions up to (excluding) 1.0.111 Added Reference Type GitHub, Inc.: https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g Types: Vendor Advisory -
New CVE Received by [email protected]
Oct. 03, 2025
Action Type Old Value New Value Added Description Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-94 Added Reference https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g