Claude Code EUVD-2025-32507

Exploitation requires a user to start Claude Code (version before 1.0.111) inside an untrusted, attacker-controlled project directory; malicious code embedded in that project's files executes before the startup trust dialog is accepted, bypassing the intended trust gate. Limiting factors that reduce real-world risk: the victim must actively launch the tool in the attacker-supplied directory (passive user interaction, UI:P), no prior authentication or privileges are needed (PR:N), and users on standard auto-update already received the fix automatically - only users who manually update and remain on < 1.0.111 are exposed.

Signals conflict and must be weighed carefully. The CVSS 4.0 base score of 8.7 (High) reflects full compromise of the vulnerable system (VC:H/VI:H/VA:H) with no privileges required (PR:N) over a network vector (AV:N), which looks alarming in isolation. However, the EPSS score is extremely low at 0.05% (14th percentile), and the vulnerability is NOT listed in CISA KEV, indicating no evidence of widespread or active exploitation. Publicly available exploit code exists (a proof-of-concept gist), which raises the floor on opportunistic risk, but POC availability is a distinct signal from active exploitation and should not be conflated. The decisive mitigating factor is the exploitation precondition captured by UI:P: a user must actively start Claude Code inside an attacker-controlled (untrusted) directory, making this a social-engineering / supply-chain-style attack rather than a remotely sprayable one. Net assessment: this is a legitimate code-injection flaw worth patching promptly, but the low EPSS, absence of KEV, and the required user action point to targeted or opportunistic developer-focused abuse rather than mass exploitation. Note the nuance between the CVSS vector and reality: AV:N is assigned, but the practical trigger requires the victim to locally launch the tool in a malicious directory - effectively a user-initiated local execution path delivered via network-shared content.

An attacker publishes a malicious repository (e.g., on a public code host) containing crafted project files. A developer clones it and starts Claude Code (version before 1.0.111) inside that directory; the embedded code executes before the user ever accepts the startup trust dialog, achieving arbitrary code execution in the developer's context. A public proof-of-concept exists, but the attack hinges on the victim launching the tool in the untrusted directory (UI:P).