CVE-2025-59828

CVE Enrichment

CVSS: 7.7 HIGH
EPSS: 0.36%
EPSS Percentile: 28.68%
CISA KEV: Not listed

Description

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to the user accepting the risks of working in an untrusted directory. Users running Yarn Classic were unaffected by this issue. This issue has been fixed in version 1.0.39. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 25-Sep-2025 03:15
Last Modified: 17-Jun-2026 16:46
EPSS Date: 2026-10-20
CWE: CWE-829, CWE-862

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

anthropic / claude_code
Version / affected range: * · before (exclusive) 1.0.39
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

References

[email protected]

Last enrichment sync: 21-Oct-2026 16:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

- **Claude Code Yarn Plugin** (CVE-2025-59828) Flashpoint Report Highlights AI-Driven Threats, Infostealers and Ransomware Trends

CVE (5)

Malware (2)

Threat Actors (2)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.