Critical Claude Code Vulnerabilities Allowed Remote Code Execution and API Key Theft

AI Coding Tools Face Security Scrutiny

Check Point Research disclosed critical vulnerabilities in Anthropic's Claude Code that allowed attackers to achieve remote code execution and steal API credentials through malicious project configurations.

The Vulnerabilities

CVE-2025-59536 (CVSS 8.7): A code injection vulnerability that executed arbitrary shell commands automatically when a user started Claude Code in an untrusted directory. The attack triggered during tool initialization — before any user action.

CVE-2026-21852 (CVSS 5.3): A broader flaw that harvested developers' API keys with no user interaction required. If a repository's settings file set ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests (including API keys) before showing the trust prompt.

Attack Vectors

The vulnerabilities exploited three Claude Code configuration mechanisms:

1. Hooks — Custom shell commands triggered by events
2. MCP Servers — Model Context Protocol server configurations
3. Environment Variables — Project-level variable overrides

The Risk

Any developer who cloned and opened an untrusted repository could have their:

• Machine compromised with arbitrary code execution
• Anthropic API key exfiltrated to attacker-controlled servers
• Development environment compromised

Fixes Applied

• CVE-2025-59536: Fixed in Claude Code version 1.0.111 (October 2025)
• CVE-2026-21852: Fixed in Claude Code version 2.0.65 (January 2026)

All reported issues were patched before the public disclosure.

Source: Check Point Research | The Hacker News | Dark Reading | CyberSecurity News