AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

CVE-2025-59536: Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the sta

highvulnerabilityLLM-Specific

security

Source: NVD/CVE DatabaseOctober 3, 2025CVE-2025-59536

Summary

Claude Code (an AI tool that writes and runs code automatically) had a security flaw in versions before 1.0.111 where it could execute code from a project before the user confirmed they trusted the project. An attacker could exploit this by tricking a user into opening a malicious project directory.

Solution / Mitigation

Update Claude Code to version 1.0.111 or later. Users with auto-update enabled will have received this fix automatically; users performing manual updates should update to the latest version.