Untrusted repositories turn Claude code into an attack vector

Anthropic's Claude Code, an agentic coding tool, contained a code injection flaw (CWE-94) caused by a bug in its startup trust dialog implementation, so all versions before 1.0.111 are affected. An attacker who controls the contents of a project directory — for example a malicious or compromised repository — can get Claude Code to execute code contained in that project before the user has accepted the startup trust dialog, bypassing the prompt meant to gate execution. The trigger is simply a user starting Claude Code in an untrusted directory (user interaction is required, per the CVSS 4.0 vector scored 8.7 High), and a successful attack yields arbitrary code execution with the developer's local privileges, potentially exposing source code and credentials accessible to that account. Users on the standard auto-update channel have already received the fix automatically, while manually updated or version-pinned installations remain exposed until upgraded to 1.0.111 or later. No public proof-of-concept or CISA KEV listing is known, but EPSS assigns a 26.4% probability of exploitation within 30 days (98th percentile), and related research on Claude Code code execution and a similar Amazon Q Developer flaw indicates active researcher and attacker interest in this attack surface.

Do: Update Claude Code to version 1.0.111 or later; auto-update users should already be patched but should verify the installed version on each workstation, while manually updated or pinned installs must be upgraded explicitly. Until patched, avoid starting Claude Code in untrusted or freshly cloned project directories, and treat trust-dialog prompts on unpatched versions as not yet protective.

Claude Code versions prior to 2.0.65 process repository settings during the project-load flow before the user has confirmed trust in a repository, and this flaw (CWE-522, insufficiently protected credentials) lets a malicious repository redirect API traffic and capture credentials. When a user opens an attacker-controlled repository, Claude Code reads a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and immediately issues API requests before the trust prompt is shown. Because those requests are sent to the attacker's endpoint, the user's Anthropic API key can be leaked to the attacker. Anyone running an affected version of Anthropic Claude Code who opens untrusted or attacker-supplied repositories is affected, while users on standard auto-update have already received the fix. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not on CISA's KEV list, but EPSS assigns a 24.8% probability of exploitation within 30 days (98th percentile).

Do: Upgrade to Claude Code 2.0.65 or later; auto-update users have already received the fix, so manually verify the installed version if updates are managed by hand. Until patched, avoid opening untrusted repositories with Claude Code, and review repository settings files for ANTHROPIC_BASE_URL overrides before trusting a project. Check API usage logs or billing for unexpected requests to unfamiliar endpoints and rotate the Anthropic API key if exposure is suspected.