High · published September 24, 2025
⚡ Before version 1.0.39, running `yarn --version` could automatically execute risky plugins, sidestepping security warnings like a sneaky raccoon raiding a picnic! 🎉 It's like a check-in desk at a hotel where the staff hands you the room key before you even agree to the terms — you might find yourself in a suite you weren't prepared for. Here, the plugins run before users can even say "no, thanks!" If exploited, an attacker could run unauthorized plugins in an untrusted directory, potentially causing serious harm to your project or system. Imagine accidentally granting access to malicious code — scary stuff! You could find your codebase compromised or sensitive information leaked. 🔥
It's like a check-in desk at a hotel where the staff hands you the room key before you even agree to the terms — you might find yourself in a suite you weren't prepared for. Here, the plugins run before users can even say "no, thanks!" This vulnerability allows plugins to execute automatically when using Yarn with Claude Code prior to version 1.0.39, bypassing the directory trust dialog that should confirm user acceptance of potential risks.
If exploited, an attacker could run unauthorized plugins in an untrusted directory, potentially causing serious harm to your project or system. Imagine accidentally granting access to malicious code — scary stuff! You could find your codebase compromised or sensitive information leaked. 🔥 To stay safe, ensure you're running Claude Code version 1.0.39 or later. If you're on Yarn Classic, you're in the clear! For manual users, check for updates and install the latest version to protect yourself. 🛡️ You’ve got this! Keep your tools updated, and you’ll be locking down your code like a pro! 🔒