Code Execution Vulnerability in Claude Code by Anthropic
CVE-2025-65099

7.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65099?

Claude Code, an agentic coding tool by Anthropic, faced a vulnerability that allowed for potential remote code execution when operating with Yarn version 3.0 or above. Users running Claude Code prior to version 1.0.39 could be tricked into executing unintended code from an untrusted project via yarn plugins before approving the startup trust dialog. To mitigate this risk, users are urged to update to the latest version 1.0.39, which addresses this critical issue in a timely manner.

Affected Version(s)

claude-code < 1.0.39

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65099 : Code Execution Vulnerability in Claude Code by Anthropic