CVE-2025-65099: high-severity vulnerability in anthropics claude-code
Claude Code vulnerable to command execution prior to startup trust dialog
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Claude Code could execute malicious code from a project before asking the user for permission, if the project used Yarn 3.0 or later. An attacker could trick a user into opening an untrusted project folder to run harmful commands.
Claude Code versions prior to 1.0.39 fail to validate startup trust before loading Yarn 3.0+ plugins, allowing arbitrary code execution through plugin mechanisms. The attack requires user interaction (opening a malicious project directory) and specific Yarn version presence; the vulnerability bypasses the trust dialog that should gate code execution.
In the same product, most dangerous first.