Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.
Fix
Public exploits 6
- AetherAI3/AETHER-PROTOCOL-P PoC on GitHub
- NetVanguard-cmd/CVE-2025-59536 PoC on GitHub
- Perufitlife/dotclaude-security PoC on GitHub
- Razi-Interactive/claude-project-scanner PoC on GitHub
- Rohitberiwala/Claude-Code-MCP-Injection-PoC PoC on GitHub
- TreRB/ai-ide-config-guard PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · anthropicNVD modified 2026-10-12 15:10
Affected (CPE criteria) 1
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*