Home

Description

Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.

PUBLISHED Reserved 2025-11-17 | Published 2025-11-19 | Updated 2025-11-20 | Assigner GitHub_M




HIGH: 7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

< 1.0.39
affected

References

github.com/...e-code/security/advisories/GHSA-5hhx-v7f6-x7gv

cve.org (CVE-2025-65099)

nvd.nist.gov (CVE-2025-65099)

Download JSON