CVE-2025-59536: anthropic claude code

csirt@kutim:~/threat-intel/cve/CVE-2025-59536

CVSS 8.8 · High EPSS 27,2%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada anthropic claude code. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.

Rincian

Terbit di NVD: 3 Oktober 2025
Terakhir diubah: 12 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 27,2% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
anthropic	claude code	Semua versi sebelum 1.0.111

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 13 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.