Executive brief
Claude Code is an AI-powered coding assistant that runs in the terminal. The tool contains a vulnerability where malicious Yarn package configuration files can execute arbitrary commands before the user is prompted to confirm they trust the working directory. An attacker could exploit this by committing malicious Yarn configs to a repository, potentially executing code with the user's privileges when Claude Code is invoked on that directory.
Technical details
Claude Code contains an improper control of code generation vulnerability (CWE-94) where it runs `yarn --version` to detect Yarn before displaying the directory trust dialog. Malicious Yarn configuration files (specifically yarnPath and plugins settings) can execute arbitrary code during this version check, bypassing the intended trust mechanism. The vulnerability requires the user to invoke Claude Code on a directory containing a malicious Yarn config file; the attack vector is network-based (code can be committed to a repository and pulled locally). This allows an attacker to execute commands with the user's privileges prior to any user consent. The fix is available in version 1.0.39 and later.
Affected products
- Anthropic @anthropic-ai/claude-code <1.0.39
Timeline
- 2025-11-19: disclosed: GHSA-5hhx-v7f6-x7gv published
- 2025-11-19: patched: Version 1.0.39 released with fix