# CVE-2025-59828: Anthropic Claude Code arbitrary code execution via Yarn plugin autoloading

Source: https://junglewise.ai/threats/cve-2025-59828-anthropic-claude-code-arbitrary-code-execution-via-yarn-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-59828 · Severity: medium · CVSS 4 · Published 2025-09-24

Claude Code is an AI-powered coding assistant that runs in a developer's terminal to help automate programming tasks. A security flaw allowed malicious code hidden in a project's configuration files to run automatically before the user could decide whether to trust the folder. This could allow an attacker to gain full control over a developer's machine if they are tricked into opening a malicious project directory.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-59828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59828 being exploited in the wild.

**How severe is CVE-2025-59828?** Medium severity, with a CVSS score of 4, published 24 September 2025.

**Which products and versions are affected?** Anthropic Claude Code < 1.0.39; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.39.

**Is there a fix for CVE-2025-59828?** Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59828 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-59828?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later

  ```sh
  npm install @anthropic-ai/claude-code@1.0.39
  ```


## Technical details

Claude Code versions prior to 1.0.39 are vulnerable to arbitrary code execution due to how the tool interacts with the Yarn package manager (versions 2.0+). When Claude Code is initialized in a directory, it may trigger 'yarn --version', which automatically loads and executes plugins or 'yarnPath' binaries defined in local configuration files (.yarnrc.yml). This occurs before the 'directory trust' dialog is presented to the user, effectively bypassing the security boundary intended to protect users from untrusted code. An attacker can exploit this by providing a repository with a malicious Yarn plugin that executes when a user opens the directory with Claude Code. The issue is fixed in version 1.0.39; users on standard auto-update are protected automatically.

## Affected products

- Anthropic Claude Code (@anthropic-ai/claude-code) < 1.0.39

## Identifiers

- CVE-2025-59828
- GHSA-2jjv-qf24-vfm4

## Timeline

- 2025-09-24: disclosed
- 2025-09-24: advisory
- 2025-09-24: patched

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-2jjv-qf24-vfm4](https://github.com/anthropics/claude-code/security/advisories/GHSA-2jjv-qf24-vfm4)
- [https://github.com/anthropics/claude-code](https://github.com/anthropics/claude-code)
- [https://www.cve.org/CVERecord?id=CVE-2025-59828](https://www.cve.org/CVERecord?id=CVE-2025-59828)
- [https://yarnpkg.com/advanced/plugin-tutorial](https://yarnpkg.com/advanced/plugin-tutorial)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)