GHSA-ph6w-f82w-28w6 Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning
Insufficient warning allowed users to inadvertently permit arbitrary code execution when starting Claude Code in untrusted directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-ph6w-f82w-28w6?
GHSA-ph6w-f82w-28w6 is a vulnerability in @anthropic-ai/claude-code, published on 3 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
When Claude Code was started in a new directory, it displayed a warning asking, "Do you trust the files in this folder?". This warning did not properly document that selecting "Yes, proceed" would allow Claude Code to execute files in the folder without additional confirmation. This may not have been clear to a user so we have updated the warning to clarify this functionality.
Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.
Thank you to https://hackerone.com/avivdon for reporting this issue!
Which versions are affected by GHSA-ph6w-f82w-28w6?
2 open source packages ship an affected version, including @anthropic-ai/claude-code.
| Package | Affected | Fixed in |
|---|---|---|
@anthropic-ai/claude-code npm | All versions | 1.0.87 |
@anthropic-ai/claude-code npm | All versions | 1.0.87 |
How do I fix GHSA-ph6w-f82w-28w6?
Upgrade @anthropic-ai/claude-code to 1.0.87 or later.
Is GHSA-ph6w-f82w-28w6 being exploited?
There is no known exploitation of GHSA-ph6w-f82w-28w6 in the wild and no public exploit code.