CVE-2025-59828: 
JavaScript vulnerability analysis and mitigation

Claude Code, an agentic coding tool, was found to have a security vulnerability (CVE-2025-59828) affecting versions prior to 1.0.39. The vulnerability was discovered and disclosed on September 24, 2025, specifically impacting installations using Yarn versions 2.0+ while users of Yarn Classic remained unaffected (GitHub Advisory).

The vulnerability involves the automatic execution of Yarn plugins when running yarn --version command, which could lead to a bypass of the directory trust dialog in Claude Code. The plugins would execute before users could accept the risks of working in an untrusted directory. The vulnerability has been assigned a CVSS v4.0 base score of 7.7 (High) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (GitHub Advisory).

The vulnerability could potentially lead to arbitrary code execution through plugin autoloading, compromising the security of the affected systems. The CVSS scoring indicates high impacts on confidentiality, integrity, and availability of the vulnerable system (GitHub Advisory).

The vulnerability has been patched in Claude Code version 1.0.39. Users with standard Claude Code auto-update enabled have automatically received the fix. Those performing manual updates are advised to update to the latest version immediately (GitHub Advisory).