CVE-2025-59536 – High Severity Remote Code Execution in Anthropic Claude Code

Key Takeaways

• CVE-2025-59536 is a High severity remote code execution vulnerability in Anthropic Claude Code.
• Attackers can execute arbitrary commands and exfiltrate API tokens by opening a malicious repository.
• Versions prior to 1.0.111 are vulnerable; auto‑updating installations are already patched.
• Immediate mitigation: verify version, enforce trusted‑only repository policies, and monitor for suspicious activity.

Overview

Claude Code is Anthropic’s AI‑assisted coding assistant that runs on Node.js. The vulnerability, identified by Check Point Research, stems from a flaw in the startup trust‑dialog implementation. When Claude Code is launched in an untrusted directory, the tool can execute code embedded in the project before the user is prompted to accept the trust dialog. This bypass enables an attacker who supplies a malicious repository to achieve remote code execution (RCE) and steal the user’s Anthropic API keys.

Technical Details

• Root cause: Improper control of code generation (CWE‑94) in the trust‑dialog logic. The dialog is intended to block execution of untrusted project files, but a logic error allows the code to run unconditionally.
• Attack vector: A crafted repository containing malicious configuration files (e.g., .claude-config, package.json scripts, or hidden startup scripts). When a victim opens the repository with Claude Code, the malicious payload is executed with the privileges of the user running the tool.
• Impact: Full RCE on the host machine and extraction of stored Anthropic API tokens, which can be used to call Claude models at the attacker’s expense or for further credential‑stealing campaigns.
• CVE metadata: CVSS v3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CWE‑94.

Severity & Impact

Affected Products

• Vendor: Anthropic
• Product: Claude Code
• Vulnerable versions: All releases prior to 1.0.111.

For a complete list of affected versions and CPE identifiers, see the CVE page.

Threat Activity & Exploitation Landscape

Signal analysis shows active exploitation reported on multiple days:

• 2026‑02‑25: 1 report of active exploitation.
• 2026‑02‑26: 4 reports, with PoC references and early‑stage exploit tooling.
• 2026‑03‑03: Additional active exploitation report, confirming continued interest.

These reports indicate that threat actors are already leveraging the flaw in the wild. For a detailed timeline, indicator breakdown, and live signal feed, visit the VulnSocial CVE page.

Actionable Insights

• Version verification: Ensure every installation runs version ≥ 1.0.111.
• Patch management: Auto‑update enabled instances are already patched; manually‑updated installations must apply the latest release.
• Repository hygiene: Enforce a policy that only trusted, vetted repositories may be opened in Claude Code. Consider disabling automatic opening of projects from unknown sources.
• API key rotation: Assume any stored API keys may be compromised; rotate them immediately and enforce least‑privilege scopes.
• Monitoring: Deploy EDR/EDR rules to detect unexpected Node.js processes spawned by Claude Code, and alert on outbound connections to Anthropic’s API endpoints from unknown binaries.
• Network segmentation: Restrict Claude Code’s network access to only the required Anthropic endpoints (e.g., api.anthropic.com).

Remediation & Mitigation

1. Check the installed version

   claude-code --version
   

2. Update to the patched release
   • If auto‑update is enabled, the tool will download version 1.0.111 automatically.
   • For manual updates, download the latest installer from the official Anthropic release channel, verify its checksum, and install.
3. Enforce trust policies
   • Configure Claude Code to require explicit user confirmation for any repository opened.
   • Disable any built‑in hooks that execute scripts automatically.
4. Rotate and protect API credentials
   • Re‑issue new Anthropic API keys.
   • Store keys in a secret manager with strict access controls.
5. Implement detection controls
   • Create alerts for the creation of hidden .claude‑trust files or execution of scripts from a repository root.
   • Monitor for abnormal outbound traffic from the Claude Code process.

Bottom Line

CVE-2025-59536 is a High severity RCE flaw in Anthropic Claude Code that allows attackers to run arbitrary code and steal API tokens via malicious repository files. The vulnerability is patched in version 1.0.111; organizations should verify their deployments, apply the patch, enforce trusted‑only repository usage, and monitor for exploitation indicators.

References

• GitHub Security Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g
• VulnSocial CVE details: https://vulnsocial.com/cve/CVE-2025-59536
• VulnSocial home: https://vulnsocial.com

#hashtags: #CVE #CVE202559536 #High #RCE #Anthropic #ClaudeCode #Vulnerability #Security