Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-59536 | Code Injection in Anthropic Claude Code Startup Trust Dialog (pre-1.0.111) Anthropic's Claude Code, an agentic coding tool, contained a code injection flaw (CWE-94) caused by a bug in its startup trust dialog implementation, so all versions before 1.0.111 are affected. An attacker who controls the contents of a project directory — for example a malicious or compromised repository — can get Claude Code to execute code contained in that project before the user has accepted the startup trust dialog, bypassing the prompt meant to gate execution. The trigger is simply a user starting Claude Code in an untrusted directory (user interaction is required, per the CVSS 4.0 vector scored 8.7 High), and a successful attack yields arbitrary code execution with the developer's local privileges, potentially exposing source code and credentials accessible to that account. Users on the standard auto-update channel have already received the fix automatically, while manually updated or version-pinned installations remain exposed until upgraded to 1.0.111 or later. No public proof-of-concept or CISA KEV listing is known, but EPSS assigns a 26.4% probability of exploitation within 30 days (98th percentile), and related research on Claude Code code execution and a similar Amazon Q Developer flaw indicates active researcher and attacker interest in this attack surface. Do: Update Claude Code to version 1.0.111 or later; auto-update users should already be patched but should verify the installed version on each workstation, while manually updated or pinned installs must be upgraded explicitly. Until patched, avoid starting Claude Code in untrusted or freshly cloned project directories, and treat trust-dialog prompts on unpatched versions as not yet protective. | 8.7 | 26% |
| largeon the order of hundreds of thousands of developer installations (local CLI; auto-update users already patched) | ||
| CVE-2026-21852 | API Key Exfiltration via Attacker-Controlled Base URL in Anthropic Claude Code Claude Code versions prior to 2.0.65 process repository settings during the project-load flow before the user has confirmed trust in a repository, and this flaw (CWE-522, insufficiently protected credentials) lets a malicious repository redirect API traffic and capture credentials. When a user opens an attacker-controlled repository, Claude Code reads a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and immediately issues API requests before the trust prompt is shown. Because those requests are sent to the attacker's endpoint, the user's Anthropic API key can be leaked to the attacker. Anyone running an affected version of Anthropic Claude Code who opens untrusted or attacker-supplied repositories is affected, while users on standard auto-update have already received the fix. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not on CISA's KEV list, but EPSS assigns a 24.8% probability of exploitation within 30 days (98th percentile). Do: Upgrade to Claude Code 2.0.65 or later; auto-update users have already received the fix, so manually verify the installed version if updates are managed by hand. Until patched, avoid opening untrusted repositories with Claude Code, and review repository settings files for ANTHROPIC_BASE_URL overrides before trusting a project. Check API usage logs or billing for unexpected requests to unfamiliar endpoints and rotate the Anthropic API key if exposure is suspected. | 5.3 | 25% |
| largeon the order of hundreds of thousands of developer users/installations (official install counts not disclosed) |
Full article510 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 25, 2026Artificial Intelligence / Vulnerability
Cybersecurity researchers have disclosed multiple security vulnerabilities in Anthropic's Claude Code, an artificial intelligence (AI)-powered coding assistant, that could result in remote code execution and theft of API credentials.
"The vulnerabilities exploit various configuration mechanisms, including Hooks, Model Context Protocol (MCP) servers, and environment variables – executing arbitrary shell commands and exfiltrating Anthropic API keys when users clone and open untrusted repositories," Check Point researchers Aviv Donenfeld and Oded Vanunu said in a report shared with The Hacker News.
The identified shortcomings fall under three broad categories -
- No CVE (CVSS score: 8.7) - A code injection vulnerability stemming from a user consent bypass when starting Claude Code in a new directory that could result in arbitrary code execution without additional confirmation via untrusted project hooks defined in .claude/settings.json. (Fixed in version 1.0.87 in September 2025)
- CVE-2025-59536 (CVSS score: 8.7) - A code injection vulnerability that allows execution of arbitrary shell commands automatically upon tool initialization when a user starts Claude Code in an untrusted directory. (Fixed in version 1.0.111 in October 2025)
- CVE-2026-21852 (CVSS score: 5.3) - An information disclosure vulnerability in Claude Code's project-load flow that allows a malicious repository to exfiltrate data, including Anthropic API keys. (Fixed in version 2.0.65 in January 2026)
"If a user started Claude Code in an attacker-controller repository, and the repository included a settings file that set ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests before showing the trust prompt, including potentially leaking the user's API keys," Anthropic said in an advisory for CVE-2026-21852.
In other words, simply opening a crafted repository is enough to exfiltrate a developer's active API key, redirect authenticated API traffic to external infrastructure, and capture credentials. This, in turn, can permit the attacker to burrow deeper into the victim's AI infrastructure.
This could potentially involve accessing shared project files, modifying/deleting cloud-stored data, uploading malicious content, and even generating unexpected API costs.
Successful exploitation of the first vulnerability could trigger stealthy execution on a developer's machine without any additional interaction beyond launching the project.
CVE-2025-59536 also achieves a similar goal, the main difference being that repository-defined configurations defined through .mcp.json and claude/settings.json file could be exploited by an attacker to override explicit user approval prior to interacting with external tools and services through the Model Context Protocol (MCP). This is achieved by setting the "enableAllProjectMcpServers" option to true.
"As AI-powered tools gain the ability to execute commands, initialize external integrations, and initiate network communication autonomously, configuration files effectively become part of the execution layer," Check Point said. "What was once considered operational context now directly influences system behavior."
"This fundamentally alters the threat model. The risk is no longer limited to running untrusted code – it now extends to opening untrusted projects. In AI-driven development environments, the supply chain begins not only with source code, but with the automation layers surrounding it."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html