CVE-2025-65099: Anthropic Claude Code command execution prior to trust dialog

CVE-2025-65099 · Severity: critical · CVSS 9.8 · Published 2025-11-19

Claude Code is an AI-powered coding assistant that runs in the terminal. The tool contains a vulnerability where malicious Yarn package configuration files can execute arbitrary commands before the user is prompted to confirm they trust the working directory. An attacker could exploit this by committing malicious Yarn configs to a repository, potentially executing code with the user's privileges when Claude Code is invoked on that directory.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2025-65099 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-65099 being exploited in the wild.
How severe is CVE-2025-65099?
Critical severity, with a CVSS score of 9.8, published 19 November 2025.
Which products and versions are affected?
Anthropic Claude Code <1.0.39; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.39.
Is there a fix for CVE-2025-65099?
Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65099 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-65099?
Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 1.0.39 or later
    npm install @anthropic-ai/claude-code@1.0.39

Technical details

Claude Code contains an improper control of code generation vulnerability (CWE-94) where it runs `yarn --version` to detect Yarn before displaying the directory trust dialog. Malicious Yarn configuration files (specifically yarnPath and plugins settings) can execute arbitrary code during this version check, bypassing the intended trust mechanism. The vulnerability requires the user to invoke Claude Code on a directory containing a malicious Yarn config file; the attack vector is network-based (code can be committed to a repository and pulled locally). This allows an attacker to execute commands with the user's privileges prior to any user consent. The fix is available in version 1.0.39 and later.

Affected products

  • Anthropic @anthropic-ai/claude-code <1.0.39

Identifiers

  • CVE-2025-65099
  • GHSA-5hhx-v7f6-x7gv

Timeline

  • 2025-11-19: disclosed: GHSA-5hhx-v7f6-x7gv published
  • 2025-11-19: patched: Version 1.0.39 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.