{"data":{"id":"d51c28ae-c31b-4fb9-940f-de7fd7c16624","title":"CVE-2025-59536: Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the…","summary":"Claude Code versions before 1.0.111 were vulnerable to Code Injection because of a bug in the startup trust dialog. The tool could be tricked into executing code contained in a project before the user accepted the dialog. Exploitation requires a user to start Claude Code in an untrusted directory.","solution":"Fixed in version 1.0.111. Users on standard auto-update received the fix automatically; users performing manual updates are advised to update to the latest version.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59536","publishedAt":"2025-10-03T07:15:44.550Z","cveId":"CVE-2025-59536","cweIds":["CWE-94"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 1.0.111 (fixed: 1.0.111)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code code injection through startup trust dialog","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.24887,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-4fgq-fpq9-mr3g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:27.724Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-09-10T22:16:23.609Z","daysToFix":-23,"fixCheckedAt":"2026-10-29T21:43:34.199Z","capecIds":["CAPEC-242"],"crossRefCount":1,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"1.0.111","matchedVersion":"1.0.111","fixReleasedAt":"2025-09-10T22:16:23.609Z","daysToFix":-23,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:34.049Z"}]}}