CVE-2025-59828 is a critical (CVSS 9.8) flaw in Claude Code before 1.0.39. With Yarn 2.0 or later installed, running yarn --version could execute Yarn plugins before the user accepted the directory trust dialog. Update to 1.0.39 or later. The sections below cover who is affected, how to check, and what to do now.
What's affected
From the GitHub advisory GHSA-2jjv-qf24-vfm4, the npm package @anthropic-ai/claude-code before 1.0.39 is affected and the fix is in 1.0.39. Users on standard auto update will have received the fix automatically. People who update by hand are advised to move to the latest version.
Per the record, users of Yarn Classic were unaffected, and the issue concerns Yarn 2.0 and later.
How to check if you're exposed
Check the installed version:
claude --version
npm ls -g @anthropic-ai/claude-code
If it shows a version below 1.0.39, update it. Look at whether auto update is enabled in your environment, since managed or pinned installs are the ones that can lag behind.
In a repository you do not trust, avoid running Yarn commands at all until you have reviewed its Yarn configuration files.
What to do now
- Update Claude Code to 1.0.39 or later and confirm the version.
- Check pinned or managed installs on build agents, shared dev containers and golden images.
- Review .yarnrc.yml and any yarnPath or plugin entries before opening unfamiliar repositories.
- Do not accept the trust dialog for directories you have not looked at.
- Keep tool auto update turned on where policy allows.
Why it matters
The record maps this to CWE-829, inclusion of functionality from an untrusted control sphere, and CWE-862, missing authorization. The tool checks the Yarn version as part of its startup. With Yarn 2.0 and later, Yarn configuration in the project can cause code to run even for a version query, and that happened before the user had been asked whether to trust the folder.
The advisory text is a little broader than the record: it says Yarn config files can trigger execution, including plugins and yarnPath. The general lesson applies to any tool with a trust prompt. Everything that touches the project directory has to happen after the user says yes, including helper commands that look harmless. This CVE is not on the CISA KEV list. The advisory credits the researchers who reported it, and the fix shipped through auto update.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-59828?
Claude Code 1.0.39, per the GitHub advisory.
Was Yarn Classic affected?
No. The record says users running Yarn Classic were unaffected.
Sources
- GitHub advisory GHSA-2jjv-qf24-vfm4
- NVD record data
Last reviewed: 18 October 2026.
