CVE-2025-59536highCode execution2025-10-03
CVE-2025-59536: Claude Code can execute commands prior to the startup trust dialog
Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.
What it is
Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory.
Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.
How to check
- Affected: @anthropic-ai/claude-code (npm) < 1.0.111.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @anthropic-ai/claude-code to 1.0.111 or later.
npm ls @anthropic-ai/claude-code -g # or: claude --versionSources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalUpGuard: 16,326 Supabase databases had readable tables
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-103435: Claude Code could be raced into writing files outside the project