Is CVE-2025-59828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59828 being exploited in the wild.

How severe is CVE-2025-59828?

Medium severity, with a CVSS score of 4, published 24 September 2025.

Which products and versions are affected?

Anthropic Claude Code < 1.0.39; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.39.

Is there a fix for CVE-2025-59828?

Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-59828 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-59828?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59828: Anthropic Claude Code arbitrary code execution via Yarn plugin autoloading

Q: Is there a fix for CVE-2025-59828?

Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-59828 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-59828?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59828 · Severity: medium · CVSS 4 · Published 2025-09-24

Claude Code is an AI-powered coding assistant that runs in a developer's terminal to help automate programming tasks. A security flaw allowed malicious code hidden in a project's configuration files to run automatically before the user could decide whether to trust the folder. This could allow an attacker to gain full control over a developer's machine if they are tricked into opening a malicious project directory.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2025-59828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59828 being exploited in the wild.
How severe is CVE-2025-59828?: Medium severity, with a CVSS score of 4, published 24 September 2025.
Which products and versions are affected?: Anthropic Claude Code < 1.0.39; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.39.
Is there a fix for CVE-2025-59828?: Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59828 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-59828?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later
```
npm install @anthropic-ai/claude-code@1.0.39
```

Technical details

Claude Code versions prior to 1.0.39 are vulnerable to arbitrary code execution due to how the tool interacts with the Yarn package manager (versions 2.0+). When Claude Code is initialized in a directory, it may trigger 'yarn --version', which automatically loads and executes plugins or 'yarnPath' binaries defined in local configuration files (.yarnrc.yml). This occurs before the 'directory trust' dialog is presented to the user, effectively bypassing the security boundary intended to protect users from untrusted code. An attacker can exploit this by providing a repository with a malicious Yarn plugin that executes when a user opens the directory with Claude Code. The issue is fixed in version 1.0.39; users on standard auto-update are protected automatically.

Affected products

Anthropic Claude Code (@anthropic-ai/claude-code) < 1.0.39

Identifiers

CVE-2025-59828
GHSA-2jjv-qf24-vfm4

Timeline

2025-09-24: disclosed
2025-09-24: advisory
2025-09-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.