CVE-2025-59536

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

History

08 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Claude Code es una herramienta de codificación agéntica. Las versiones anteriores a la 1.0.111 eran vulnerables a la inyección de código debido a un error en la implementación del diálogo de confianza de inicio. Se podía engañar a Claude Code para que ejecutara código contenido en un proyecto antes de que el usuario aceptara el diálogo de confianza de inicio. La explotación de esto requiere que un usuario inicie Claude Code en un directorio no confiable. Los usuarios con la actualización automática estándar de Claude Code habrán recibido esta corrección automáticamente. Se aconseja a los usuarios que realizan actualizaciones manuales que actualicen a la última versión. Este problema está solucionado en la versión 1.0.111.

Information

Published : 2025-10-03 07:15

Updated : 2026-10-12 15:10

NVD link : CVE-2025-59536

Mitre link : CVE-2025-59536

CVE.ORG link : CVE-2025-59536

JSON object : View

Products Affected

anthropic

claude_code

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-59536", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59536", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T13:26:09.204169Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"status": "affected", "version": "< 1.0.111"}]}]}], "published": "2025-10-03T07:15:44.550", "references": [{"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111."}, {"lang": "es", "value": "Claude Code es una herramienta de codificaci\u00f3n ag\u00e9ntica. Las versiones anteriores a la 1.0.111 eran vulnerables a la inyecci\u00f3n de c\u00f3digo debido a un error en la implementaci\u00f3n del di\u00e1logo de confianza de inicio. Se pod\u00eda enga\u00f1ar a Claude Code para que ejecutara c\u00f3digo contenido en un proyecto antes de que el usuario aceptara el di\u00e1logo de confianza de inicio. La explotaci\u00f3n de esto requiere que un usuario inicie Claude Code en un directorio no confiable. Los usuarios con la actualizaci\u00f3n autom\u00e1tica est\u00e1ndar de Claude Code habr\u00e1n recibido esta correcci\u00f3n autom\u00e1ticamente. Se aconseja a los usuarios que realizan actualizaciones manuales que actualicen a la \u00faltima versi\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 1.0.111."}], "lastModified": "2026-10-12T15:10:00.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F3228CCD-772D-459F-ACFD-0230FD8AB721", "versionEndExcluding": "1.0.111"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}