CVE-2025-65099: Command Execution Vulnerability in @anthropic-ai/claude-code Prior to Startup Trust Dialog
Summary
CVE-2025-65099: Claude Code vulnerable to command execution prior to startup trust dialog. Affects @anthropic-ai/claude-code versions < 1.0.39. Fixed in 1.0.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is an advanced code editor developed by Anthropic AI, designed to assist developers with intelligent code suggestions and enhancements. It integrates with package managers like Yarn to streamline project dependencies and workflows. However, a vulnerability has been identified that allows for potential command execution before the user has accepted the startup trust dialog, particularly when using Yarn version 3.0 or above.
Vulnerability Detail
The vulnerability arises when Claude Code is executed in an untrusted directory with Yarn 3.0 or above. Malicious actors can exploit this flaw to execute arbitrary code contained within project files via yarn plugins before the user is prompted to accept the startup trust dialog. This could lead to unauthorized access or manipulation of the user's environment, posing significant security risks.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.39
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@1.0.39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid running Claude Code in untrusted directories until the package is updated. Additionally, consider using Yarn versions prior to 3.0 if feasible.
Conclusion
In summary, CVE-2025-65099 presents a significant security risk for users of the @anthropic-ai/claude-code package when used with Yarn 3.0 or above. Users are strongly encouraged to update to version 1.0.39 or later to mitigate this risk and ensure their development environment remains secure.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2025-65099 is a security vulnerability in the @anthropic-ai/claude-code package that allows for command execution before the startup trust dialog is accepted.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in real-time based on your package-lock.json file. Visit Vulert Scanner to use the Vulert playground.
If an immediate update is not possible, avoid running Claude Code in untrusted directories and consider downgrading Yarn to a version below 3.0 as a temporary measure.
The vulnerability was reported by Benjamin Faller from Redguard AG and Michael Hess.
Exploitation of this vulnerability could lead to unauthorized code execution, potentially compromising the user's system and data.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
