GHSA-4fgq-fpq9-mr3g

Claude Code can execute commands prior to the startup trust dialog

Source: GitHub Advisory Database (reviewed) High CVE-2025-59536

Packages

Ecosystem	Package	Affected	Fixed in
npm	@anthropic-ai/claude-code	< 1.0.111	1.0.111

Details

As written in the advisory (Markdown source, shown as plain text).

Due to a bug in the startup trust dialog implementation, Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Thank you to https://hackerone.com/avivdon for reporting this issue!

References

External links from the advisory. They lead to third-party sites.

https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g web
https://nvd.nist.gov/vuln/detail/CVE-2025-59536 advisory
https://github.com/anthropics/claude-code package