PT-2025-40458 · Anthropic · Claude-Code

Avivdon · CVE-2025-59536 · Published 2025-10-03 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.111

Description Claude Code is an agentic coding tool that contains a bug in the startup trust dialog implementation. This flaw allows for code injection, where the tool can be tricked into executing code contained within a project before the user has accepted the startup trust dialog. Successful exploitation requires a user to start the tool in an untrusted directory.

Recommendations Update to version 1.0.111 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-59536

GHSA-4FGQ-FPQ9-MR3G

Affected Products

Claude-Code

References · 79

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59536.json · Exploit
• https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59536 · Security Note
• https://osv.dev/vulnerability/GHSA-4fgq-fpq9-mr3g · Vendor Advisory
• https://github.com/anthropics/claude-code · Note
• https://twitter.com/jiayun/status/2027390456578138166 · Twitter Post
• https://twitter.com/byte_guard_blog/status/2052712064104255566 · Twitter Post
• https://twitter.com/getcomorando/status/2038944662946213991 · Twitter Post
• https://t.me/CVEtracker/33996 · Telegram Post
• https://twitter.com/tars_mistaike/status/2033952817975607641 · Twitter Post
• https://twitter.com/ArgusForge/status/2028053791426154822 · Twitter Post
• https://twitter.com/RiteshKewlani/status/2041583304558964898 · Twitter Post
• https://twitter.com/node2040/status/2029452098643832982 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1refnrd/caught_in_the_hook_rce_and_api_token_exfiltration · Reddit Post