Untrusted search path in Claude Code - CVE-2025-59828
Published: April 30, 2026
Vulnerability identifier: #VU128524
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-59828
CWE-ID: CWE-426
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper trust management in plugin autoloading and Yarn configuration handling when running yarn --version in an untrusted directory. A remote attacker can place a specially crafted Yarn configuration file to execute arbitrary code.
User interaction is required because exploitation occurs before the user accepts the risks of working in an untrusted directory.
Affected software
Claude Code
How to mitigate CVE-2025-59828
Install security update from vendor's website.
Claude Code - update to 1.0.39