# CVE-2025-59536: CVE-2025-59536: Claude Code RCE via Hooks/MCP in Untrusted Repositories

> CVE-2025-59536 is a critical-severity remote code execution issue in Claude Code, an AI agent. Affected: Claude Code < 1.0.111. Fixed in 1.0.111.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2025-59536
- **Aliases:** ti-005
- **Severity:** critical
- **Attack type:** Remote code execution
- **Component:** Claude Code (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-02-25
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2025-59536

## Summary

Arbitrary shell commands embedded in Hooks and MCP server definitions inside a malicious repository's .claude/settings.json executed automatically when a developer ran Claude Code in that directory, before any trust prompt appeared. Patched in Claude Code v1.0.111 in October 2025 but publicly disclosed by Check Point Research in February 2026 alongside a companion API key exfiltration vulnerability.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code < 1.0.111 | 1.0.111 |

## Am I affected by CVE-2025-59536?

You are affected if you run Claude Code < 1.0.111. Versions 1.0.111 and later include the fix.

## How do I fix CVE-2025-59536?

Upgrade Claude Code to v1.0.111+. Review .claude/settings.json in untrusted repos before opening. Policy: deny hooks and MCP definitions from untrusted project configs.

## How do I find every machine running Claude Code?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.

## References

- article: https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/
- cve: https://nvd.nist.gov/vuln/detail/CVE-2025-59536

## Related vulnerabilities

- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [a-repo-defined-claude-code-subagent-downgraded-its-own-security-review](https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review) — medium
- [CVE-2026-54316](https://catalog.anomity.ai/vuln/cve-2026-54316) — high
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [CVE-2026-46406](https://catalog.anomity.ai/vuln/cve-2026-46406) — medium
- [trustfall-one-click-rce-via-claude-code-trust-dialog-regression](https://catalog.anomity.ai/vuln/trustfall-one-click-rce-via-claude-code-trust-dialog-regression) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2025-59536