CVE-2025-65099
📋 TL;DR
CVE-2025-65099 is a critical code execution vulnerability in Claude Code where Yarn plugins could execute malicious code before user consent. This affects users running Claude Code versions below 1.0.39 with Yarn 3.0+ in untrusted directories. Attackers could gain arbitrary code execution on the victim's system.
💻 Affected Systems
- Claude Code
📦 What is this software?
Claude Code by Anthropic
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution, allowing attackers to steal data, install malware, or pivot to other systems.
Likely Case
Local privilege escalation and data theft from the compromised user's environment and project files.
If Mitigated
No impact if users avoid untrusted directories or have patched to version 1.0.39+.
🎯 Exploit Status
Exploitation requires user interaction (opening Claude Code in untrusted directory) and specific Yarn version.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.39
Vendor Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-5hhx-v7f6-x7gv
Restart Required: Yes
Instructions:
1. Update Claude Code to version 1.0.39 or later via your package manager or download from official sources. 2. Restart Claude Code to apply the fix.
🔧 Temporary Workarounds
Avoid untrusted directories
allOnly run Claude Code in trusted project directories that you control.
Downgrade Yarn
allUse Yarn version below 3.0 to avoid the plugin execution vulnerability.
npm install -g yarn@2.4.3
🧯 If You Can't Patch
- Implement strict policies prohibiting Claude Code use in untrusted directories or with untrusted projects.
- Use application allowlisting to restrict Claude Code execution to specific trusted directories only.
🔍 How to Verify
Check if Vulnerable:
Check Claude Code version (must be <1.0.39) and verify Yarn version (must be >=3.0).Check Version:
claude-code --versionVerify Fix Applied:
Confirm Claude Code version is 1.0.39 or higher and test that Yarn plugins don't execute before trust dialog.📡 Detection & Monitoring
Log Indicators:
- Unexpected Yarn plugin execution before trust dialog
- Claude Code process spawning from untrusted directories
Network Indicators:
- Unusual outbound connections from Claude Code process to unknown domains
SIEM Query:
Process creation where parent_process contains 'claude-code' and command_line contains 'yarn' or 'plugin'