{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2025-59536",
    "name": "CVE-2025-59536",
    "vendor": "Claude Code",
    "description": "Arbitrary shell commands embedded in Hooks and MCP server definitions inside a malicious repository's .claude/settings.json executed automatically when a developer ran Claude Code in that directory, before any trust prompt appeared. Patched in Claude Code v1.0.111 in October 2025 but publicly disclosed by Check Point Research in February 2026 alongside a companion API key exfiltration vulnerability.",
    "website": "https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-02-25",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2025-59536",
      "aliases": [
        "ti-005"
      ],
      "title": "CVE-2025-59536: Claude Code RCE via Hooks/MCP in Untrusted Repositories",
      "summary": "Arbitrary shell commands embedded in Hooks and MCP server definitions inside a malicious repository's .claude/settings.json executed automatically when a developer ran Claude Code in that directory, before any trust prompt appeared. Patched in Claude Code v1.0.111 in October 2025 but publicly disclosed by Check Point Research in February 2026 alongside a companion API key exfiltration vulnerability.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code < 1.0.111",
          "fixed": "1.0.111"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-02-25",
      "modifiedAt": "2026-02-25",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59536"
        }
      ],
      "mitigation": "Upgrade Claude Code to v1.0.111+. Review .claude/settings.json in untrusted repos before opening. Policy: deny hooks and MCP definitions from untrusted project configs.",
      "detectedByAnomity": true
    }
  }
}