Claude Code Project Files RCE & API Token Exfiltration (CVE-2025-59536 & CVE-2026-21852)
Date: 2026-02-25
Affected: Claude Code Project Files RCE & API Token Exfiltration (CVE-2025-59536 & CVE-2026-21852)
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2025-59536
CVE-2026-21852
CWE: CWE-522
CWE-94
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-59536: Malicious `.claude/settings.json` hooks execute shell commands on SessionStart, achieving RCE before user reads the trust dialog. CVE-2026-21852: Malicious repos exfiltrate Anthropic API keys by overriding ANTHROPIC_BASE_URL to attacker-controlled servers. A single malicious commit could compromise any developer.


Mitigations:

Architectural layers (MAESTRO):