Claude Code Command Execution Vulnerability Prior to Trust Dialog Acceptance

A command execution vulnerability has been identified in Claude Code versions prior to 1.0.39, when running on a machine with Yarn 3.0 or above. The issue arises from the application's ability to execute code from a project via Yarn plugins before the user has accepted the startup trust dialog. Exploitation of this vulnerability would require the user to launch Claude Code in an untrusted directory while using Yarn 3.0 or above.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution within the context of the user running Claude Code.

Remediation

Users on the standard Claude Code auto-update will have received the fix automatically. Those performing manual updates are advised to update to the latest version.