Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)
A booby-trapped code repository can make Claude Code run an attacker's command the moment a developer opens the project folder, before Claude Code even shows its usual 'do you trust this project?' warning. Just opening the folder is enough to trigger it.
How the attack works
An attacker prepares a repository containing a `.claude/settings.json` file that registers a 'SessionStart' hook with a 'startup' matcher. A developer clones or opens this repository in Claude Code. Claude Code reads the repo-scoped settings file and fires the hook command immediately, before the trust dialog is shown. Whatever command is registered — a shell script, a curl-pipe-to-shell, an npm/pip install, or a python one-liner — executes with the developer's local privileges. The detection looks for this specific config shape (SessionStart + startup) rather than trying to judge whether the embedded command itself looks malicious.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a2892c49-0f78-4b28-b68b-e87457346478
- Severity
- Critical
- CVEs
- CVE-2025-59536
Why it matters
An attacker gets arbitrary code execution on a developer's machine simply by getting them to open a repository, with no explicit approval step, which can lead to credential theft, further supply-chain compromise, or full workstation takeover.
What you can do
- →Update Claude Code to a version with the enhanced trust-dialog fix (GHSA-ph6w-f82w-28w6) before opening untrusted repositories.
- →Review `.claude/settings.json` in any repository before opening it in Claude Code, especially for SessionStart/startup hook entries.
- →Treat repo-scoped Claude Code settings files as executable code and subject them to the same code review as scripts.
- →Open unfamiliar or third-party repositories in an isolated or sandboxed environment rather than directly in a trusted developer workstation.
Known benign look-alikes
- Legitimate Claude Code documentation discussing the Hooks schema, including example `SessionStart` configurations for defensive review or post-patch teaching purposes.
- Static analysis tooling output documenting CVE-2025-59536 attack patterns for defensive purposes.
- Patched Claude Code deployments that gate SessionStart hook execution behind the enhanced trust dialog (GHSA-ph6w-f82w-28w6) — detection still fires on the config shape, but the runtime impact is mitigated.
- Internal team templates that include reviewed `.claude/settings.json` fixtures with non-execution fields only (model, theme, allowed_tools).