Two Named CVEs Turn Claude Code Project Files Into Attack Weapons

Check Point Research disclosed CVE-2025-59536 and CVE-2026-21852 — two vulnerabilities that weaponize Claude Code's project configuration system against its users. This matters because an Agents Anonymous survey this week showed 90% of practitioners at their SF meetup use Claude Code. The attack surface is massive.

The first vector: a malicious .claude directory in a cloned repository can set ANTHROPIC_BASE_URL to redirect all API traffic — including full authorization headers with your API key — to an attacker-controlled server. The redirect happens before the user sees a trust dialog. You clone a repo, open it in Claude Code, and your API credentials are exfiltrated in plaintext before you've read a single line of code.

The second vector exploits Claude Code's hook execution model. A crafted CLAUDE.md file can inject arbitrary shell commands into the agent lifecycle — commands that execute with your user permissions the instant Claude Code opens the project. RCE via documentation. Not via exploit code. Via a markdown file.

The defense is behavioral, not technical: treat .claude/ project files like executable code in your threat model. Never open unreviewed repositories in Claude Code without first inspecting the .claude directory and any CLAUDE.md files. If you're cloning repos from untrusted sources — and GitHub forks from strangers count as untrusted — audit the project configuration files before launching your agent.

This converges with the bot PR finding above in an ugly way. If bots are submitting PRs that introduce or modify CLAUDE.md files in popular repos, and those PRs merge without adequate review, the next developer who clones and opens that repo in Claude Code is compromised. The supply chain attack doesn't require the victim to install anything unusual. They just have to open a project in the tool 90% of practitioners already use daily.