CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.
Other sources
When running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory running Yarn 3.0 or above.
Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.
Thank you to Benjamin Faller, Redguard AG and Michael Hess for reporting this issue!
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65099?
CVE-2025-65099 is considered a high-severity vulnerability as it allows execution of untrusted code prior to user approval.
How do I fix CVE-2025-65099?
To fix CVE-2025-65099, update Claude Code to version 1.0.39 or higher to mitigate the risk.
What software is affected by CVE-2025-65099?
CVE-2025-65099 affects Claude Code versions prior to 1.0.39 running on machines with Yarn 3.0 or above.
What could happen if CVE-2025-65099 is exploited?
If exploited, CVE-2025-65099 could allow an attacker to execute malicious code without the user's consent.
Is there a workaround for CVE-2025-65099?
Currently, the recommended solution for CVE-2025-65099 is to upgrade to the latest version of Claude Code.