CVE-2025-59536: Claude Code RCE via Hooks/MCP in Untrusted Repositories
CVE-2025-59536 is a critical-severity remote code execution issue in Claude Code, an AI agent. Affected: Claude Code < 1.0.111. Fixed in 1.0.111.
Is Claude Code running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2025-59536- Severity
- critical
- Attack type
- Remote code execution
- Component
- Claude Code · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2025-59536?
Arbitrary shell commands embedded in Hooks and MCP server definitions inside a malicious repository's .claude/settings.json executed automatically when a developer ran Claude Code in that directory, before any trust prompt appeared. Patched in Claude Code v1.0.111 in October 2025 but publicly disclosed by Check Point Research in February 2026 alongside a companion API key exfiltration vulnerability.
Affected versions
| Affected | Fixed in |
|---|---|
Claude Code < 1.0.111 | 1.0.111 |
Am I affected by CVE-2025-59536?
You are affected if you run Claude Code < 1.0.111. Versions 1.0.111 and later include the fix.
How do I fix CVE-2025-59536?
Upgrade Claude Code to v1.0.111+. Review .claude/settings.json in untrusted repos before opening. Policy: deny hooks and MCP definitions from untrusted project configs.
How do I find every machine running Claude Code?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.