Executive brief
Claude Code is an AI-powered coding assistant that runs in a developer's terminal to help automate programming tasks. A security flaw allowed malicious code hidden in a project's configuration files to run automatically before the user could decide whether to trust the folder. This could allow an attacker to gain full control over a developer's machine if they are tricked into opening a malicious project directory.
Technical details
Claude Code versions prior to 1.0.39 are vulnerable to arbitrary code execution due to how the tool interacts with the Yarn package manager (versions 2.0+). When Claude Code is initialized in a directory, it may trigger 'yarn --version', which automatically loads and executes plugins or 'yarnPath' binaries defined in local configuration files (.yarnrc.yml). This occurs before the 'directory trust' dialog is presented to the user, effectively bypassing the security boundary intended to protect users from untrusted code. An attacker can exploit this by providing a repository with a malicious Yarn plugin that executes when a user opens the directory with Claude Code. The issue is fixed in version 1.0.39; users on standard auto-update are protected automatically.
Affected products
- Anthropic Claude Code (@anthropic-ai/claude-code) < 1.0.39
Timeline
- 2025-09-24: disclosed
- 2025-09-24: advisory
- 2025-09-24: patched