CVE-2025-65099: 
JavaScript vulnerability analysis and mitigation

CVE-2025-65099 is a code injection vulnerability in Anthropic's Claude Code agentic coding tool, classified as "Command execution prior to Claude Code startup trust dialog." Prior to version 1.0.39, Claude Code could be tricked into executing malicious code embedded in a project via Yarn plugins before the user accepted the startup trust dialog, effectively bypassing the directory trust mechanism. The vulnerability affects all versions of @anthropic-ai/claude-code (npm) below 1.0.39 running on systems with Yarn 3.0 or above. It was published and patched on November 19, 2025. The CVSS v4.0 score is 7.7 (High) per the CNA (GitHub), while NVD assigned a CVSS v3.1 score of 9.8 (Critical) (Github Advisory, Anthropic Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): when Claude Code initializes in a directory containing a Yarn 3.0+ configuration, it invokes yarn --version as part of its startup process, which can trigger execution of code specified in Yarn config files — specifically via plugins or yarnPath settings — before the user has had the opportunity to accept or reject the directory trust dialog (Github Advisory). This means a malicious project repository could include a crafted .yarnrc.yml file specifying a malicious plugin or custom yarnPath, and any developer who opens Claude Code in that directory would have that code executed on their machine without any trust prompt (Anthropic Advisory). Exploitation requires two preconditions: the victim must start Claude Code in an untrusted directory, and the system must have Yarn 3.0 or above installed. A proof-of-concept related to Claude Code RCE via deeplink handlers and settings injection has been referenced publicly (undercodetesting.com).

Successful exploitation allows an attacker to execute arbitrary code on the victim's machine in the context of the user running Claude Code, before any trust verification occurs. This can result in full confidentiality, integrity, and availability compromise of the affected system — including unauthorized access to source code, credentials, and sensitive files, installation of malware or backdoors, and potential lateral movement within the developer's environment (Github Advisory, Anthropic Advisory). The attack is particularly dangerous in supply chain scenarios where a developer clones a malicious or compromised repository and opens it with Claude Code.

No confirmed in-the-wild exploitation has been reported, and no public proof-of-concept specifically for CVE-2025-65099 is known at this time, though a related Claude Code RCE research post exists (undercodetesting.com). The EPSS score is approximately 0.104–0.141%, placing it in the 34th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening Claude Code in an untrusted directory) and the presence of Yarn 3.0+, which limits the attack surface compared to fully remote, unauthenticated vulnerabilities.

1. Prepare malicious repository: Create or compromise a project repository and add a crafted .yarnrc.yml file specifying a malicious Yarn plugin path or a custom yarnPath pointing to attacker-controlled code (e.g., a script that exfiltrates data or establishes a reverse shell).
2. Distribute the repository: Host the malicious repository on a public platform (e.g., GitHub) or distribute it via phishing, supply chain compromise, or social engineering to target developers who use Claude Code.
3. Victim clones the repository: The target developer clones or downloads the malicious project directory to their local machine.
4. Victim opens Claude Code: The developer navigates to the project directory and launches Claude Code (e.g., runs claude in the terminal).
5. Yarn plugin executes before trust dialog: Claude Code invokes yarn --version during initialization, which triggers the malicious Yarn plugin or yarnPath script specified in .yarnrc.yml — executing attacker-controlled code on the victim's machine before the startup trust dialog is displayed.
6. Achieve objective: The attacker's payload runs with the victim's user privileges, enabling data theft, persistence, or further lateral movement (Github Advisory, Anthropic Advisory).

• File System: Presence of a suspicious or unexpected .yarnrc.yml file in a project directory specifying unusual plugins entries or a non-standard yarnPath value; unexpected scripts or binaries referenced by yarnPath in the project directory.
• Process: Unexpected child processes spawned by the Claude Code process (e.g., node, bash, sh, python, curl, wget) immediately upon startup, before any user interaction; unusual network connections initiated by processes spawned from the Claude Code parent process.
• Network: Outbound connections to unknown or suspicious IP addresses or domains originating from the developer's workstation shortly after opening Claude Code in a project directory.
• Logs: Shell history or process audit logs showing yarn --version execution followed by unexpected subprocess activity; system logs indicating execution of scripts from within a cloned project directory.

Anthropic has released a patch in Claude Code version 1.0.39, which prevents Yarn plugins and yarnPath from being executed before the user accepts the startup trust dialog (Github Advisory). Users on standard Claude Code auto-update will have received this fix automatically; those performing manual updates should upgrade to version 1.0.39 or later immediately. As interim workarounds: only open Claude Code in directories from trusted sources, avoid running Claude Code in directories containing unknown or unreviewed Yarn configuration files, and implement code review processes for project dependencies and configuration files before opening them with agentic tools (Anthropic Advisory).

The vulnerability was reported by Benjamin Faller (Redguard AG) and Michael Hess, and was acknowledged and patched by Anthropic on the same day of disclosure (November 19, 2025) (Github Advisory). The issue was picked up by vulnerability tracking platforms including Qualys (detection ID 5006277), GitLab Advisories, INCIBE-CERT, and CIRCL, indicating broad awareness in the security community. Social media activity was noted on Bluesky shortly after disclosure. No major media coverage or significant public controversy has been identified beyond standard vulnerability tracking.