PT-2025-40458

CVE-2025-59536

Published

2025-10-03

Updated

2026-11-09

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.111

Description Claude Code, an agentic coding tool, contains a bug in the startup trust dialog implementation that allows for code injection. This issue enables the tool to be tricked into executing code within a project before the user has accepted the startup trust dialog. Successful exploitation requires the user to start the application in an untrusted directory.

Recommendations Update to version 1.0.111 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Avivdon

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers