CVE-2025-65099 is a code execution flaw in Claude Code before version 1.0.39. On a machine with Yarn 3.0 or above, a project could run code through Yarn plugins before the user accepted the startup trust dialog. The record scores it 9.8 critical, the advisory says high. Update to 1.0.39.
What's affected
Claude Code versions before 1.0.39 are affected, and 1.0.39 contains the fix. The GitHub advisory lists the npm package @anthropic-ai/claude-code with a vulnerable range below 1.0.39.
Two conditions apply, and both appear in the record. The user must start Claude Code in an untrusted directory, and must be using Yarn 3.0 or above. The advisory adds the mechanism. Yarn configuration files can trigger code execution when Yarn is run with its version flag, so plugins and the yarnPath setting could run before the user accepted the risks of working in an untrusted directory.
On severity, the record gives a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical. The GitHub advisory labels the same flaw High. The two conditions above are part of the reason the maintainers' label is lower than the automated score. Both are published, so use both. The advisory also says users on standard auto-update received the fix automatically.
How to check if you're exposed
Check the installed version of the CLI. Either of these works:
claude --version
npm ls -g @anthropic-ai/claude-code
If you install Claude Code per project or in a container image, check those images and lockfiles too. A CI image that was built months ago may still carry an older version, even if laptops auto-updated.
To see whether the Yarn condition applies to you, check the Yarn version on developer machines:
yarn --version
Version 3.0 or above meets the condition in the record.
What to do now
- Update Claude Code to 1.0.39 or later, and confirm the version after updating.
- Treat the trust dialog as a real decision. Open unfamiliar repositories in a disposable environment, not on your main workstation.
- Review projects that contain Yarn configuration, plugin or yarnPath entries before opening them in any tool that runs Yarn.
- Rebuild container or CI images that carry an older Claude Code.
- Add a minimum Claude Code version to your developer tooling policy.
Why it matters
The weakness is CWE-94, code injection. The design promise of a trust dialog is that nothing from the project runs until the user agrees. Here, merely asking Yarn for its version let the project's own configuration run code first. A check that runs another tool can inherit that tool's behavior.
That is a good lesson for any developer tool that inspects a project before trusting it. Even a harmless looking probe, like asking a package manager for its version, can execute project controlled code. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Why does the record say critical when the advisory says high?
The record's 9.8 assumes the attacker needs nothing. The advisory label reflects the conditions: an untrusted directory and Yarn 3.0 or above. Both ratings are published.
Is a fix available without updating?
The advisory names only the update to 1.0.39. Avoid opening untrusted directories until you have updated.
Sources
Last reviewed: 18 October 2026.
