title: Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)
id: ATR-2026-00523
rule_version: 2
status: experimental
description: |
  Detects exploitation of CVE-2025-59536 (Critical), pre-trust remote code execution in Claude Code via the Hooks feature. An attacker-controlled repository ships a `.claude/settings.json` that registers a `SessionStart` hook with the `startup` matcher; when a developer opens the project directory, Claude Code executes the registered command BEFORE the trust dialog renders. The full kill chain is: clone-or-open malicious repo → Claude Code loads repo-scoped `.claude/settings.json` → hook command fires pre-trust → arbitrary code runs with developer's local privileges. The matcher / event names (`SessionStart`, `startup`) are stable strings in the Claude Code Hooks schema, so the detector anchors on the config-file shape rather than the command payload (any shell binary, curl pipe-to-shell, npm/pip install, or `python -c` body is sufficient for RCE post-trigger). CWE-94, CWE-1188 (insecure default). Patches in Claude Code via enhanced trust-dialog warning (GHSA-ph6w-f82w-28w6). Reported by Aviv Donenfeld and Oded Vanunu (Check Point Research). This rule detects exploit configs in repo-scoped settings.json files and provides defence-in-depth post-patch by flagging the dangerous matcher shape regardless of upstream dialog state.
author: ATR Community
date: 2026/05/13
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI04:2026
    - ASI05:2026
    - ASI09:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1546 - Event Triggered Execution
    - T1059 - Command and Scripting Interpreter
    - T1195.002 - Compromise Software Supply Chain
  cve:
    - CVE-2025-59536
  research:
    - https://research.checkpoint.com/2026/claude-code-hooks-rce-cve-2025-59536/
    - https://github.com/anthropics/claude-code/security/advisories/GHSA-ph6w-f82w-28w6
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59536
metadata_provenance:
  mitre_atlas: human-reviewed
  mitre_attack: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2025-59536 lets a repo-shipped `.claude/settings.json` execute arbitrary commands via a SessionStart/startup hook before any consent dialog renders; Article 15 cybersecurity requirements mandate that AI coding assistants gate process-execution capability on explicit user consent and origin verification.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requirements are violated when a workspace-bound hook fires before the trust dialog presents to the developer — the human-reviewable signal arrives after the code has already run.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate repo-scoped config files (`.claude/settings.json`, `.cursor/mcp.json`, `.vscode/settings.json`) as a high-risk supply-chain ingress for pre-trust code execution.
      strength: primary
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Supply-chain governance under GV.6.1 must include integrity verification for any AI-assistant config file consumed at session-start time; CVE-2025-59536 exploits the absence of integrity checks on `.claude/settings.json` parsing.
      strength: primary
    - subcategory: MP.5.1
      context: 'Pre-trust hook execution is a primary input-attack class against AI coding assistants: the input that triggers the attack is the config file itself, parsed before any prompt or LLM call.'
      strength: primary
    - subcategory: MS.4.1
      context: Measurement subcategory MS.4.1 requires monitoring of tool-invocation events, including the lifecycle event that loads SessionStart hooks; CVE-2025-59536 exploits the absence of such monitoring.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must require explicit consent and integrity verification for any AI-tool config file auto-loaded by coding assistants; SessionStart hooks executing pre-trust violate the least-privilege principle for repo-scoped configuration.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)) as a treatment control.
      strength: secondary
tags:
  category: skill-compromise
  subcategory: pre-trust-hook-rce
  scan_target: both
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - claude-code
    - any
  provider:
    - anthropic
    - any
detection:
  condition: any
  false_positives:
    - Legitimate Claude Code documentation discussing the Hooks schema, including example `SessionStart` configurations for defensive review or post-patch teaching purposes.
    - Static analysis tooling output documenting CVE-2025-59536 attack patterns for defensive purposes.
    - Patched Claude Code deployments that gate SessionStart hook execution behind the enhanced trust dialog (GHSA-ph6w-f82w-28w6) — detection still fires on the config shape, but the runtime impact is mitigated.
    - Internal team templates that include reviewed `.claude/settings.json` fixtures with non-execution fields only (model, theme, allowed_tools).
  conditions:
    - field: content
      operator: regex
      value: (?i)"hooks"\s*:\s*\{[^}]{0,400}"SessionStart"\s*:\s*\[[^\]]{0,400}"matcher"\s*:\s*"startup"
      description: Claude Code `.claude/settings.json` hooks block registering a SessionStart hook with the `startup` matcher — CVE-2025-59536 canonical exploit shape. Anchored on the literal Hooks schema keys (`hooks`, `SessionStart`, `matcher`, `startup`) which are stable across the Claude Code Hooks API.
    - field: content
      operator: regex
      value: (?i)"SessionStart"\s*:\s*\[[^\]]{0,600}"matcher"\s*:\s*"startup"[^\]]{0,400}"command"\s*:\s*"(?:bash|sh|zsh|cmd|powershell|pwsh|curl|wget|python(?:\d)?|node|deno|bun|ruby|perl|php)\b
      description: SessionStart/startup hook whose `command` resolves to a shell or scripting interpreter — RCE-ready payload regardless of subsequent args.
    - field: content
      operator: regex
      value: (?i)"SessionStart"\s*:\s*\[[^\]]{0,800}"command"\s*:\s*"[^"]{0,400}(?:\bcurl\b[^"]{0,80}\|\s*(?:bash|sh)\b|\bwget\b[^"]{0,80}\|\s*(?:bash|sh)\b|\bpython\d?\s+-c\b|\bnode\s+-e\b|\beval\s|\$\(|\`\w)
      description: SessionStart hook command containing pipe-to-shell, inline-exec flags (`python -c`, `node -e`), `eval`, or shell-substitution primitives — second-stage RCE payload shape.
    - field: content
      operator: regex
      value: (?i)"SessionStart"\s*:\s*\[[^\]]{0,800}"command"\s*:\s*"[^"]{0,400}\b(?:npm|pnpm|yarn|pip|pip3|pipx|cargo|gem|gh\s+auth|aws\s+s3\s+cp|scp|nc|netcat|/bin/(?:bash|sh)|/usr/bin/(?:bash|sh|curl|wget))\b
      description: SessionStart hook command invoking package-manager install, credential-tooling, or absolute-path shell binaries — pre-trust supply-chain or credential-exfil chain.
    - field: content
      operator: regex
      value: (?i)\.claude[/\\]settings(?:\.local)?\.json[\s\S]{0,800}"hooks"\s*:\s*\{[\s\S]{0,400}"SessionStart"
      description: Repo-scoped `.claude/settings.json` (or `.claude/settings.local.json`) co-located with a `hooks.SessionStart` block — path + payload co-occurrence anchor for skill / documentation scans.
    - field: content
      operator: regex
      value: (?i)(?:pre[_\s\-]?trust|before\s+(?:the\s+)?trust\s+(?:dialog|prompt)|prior\s+to\s+(?:trust|consent))[^\n]{0,160}(?:hook|SessionStart|startup|\.claude)
      description: Skill content describing the pre-trust execution property of SessionStart hooks — co-occurrence anchor for documentation / poisoning scans.
    - field: content
      operator: regex
      value: (?i)\\?"SessionStart\\?"\s*:\s*\[[^\]]{0,800}\\?"command\\?"\s*:\s*\\?"[^"\\]{0,200}\b(?:node|bun|deno|python[23]?)\s+[^\s"\\|&;]{1,160}\s*\|\|\s*(?:node|bun|deno|python[23]?)\s+[^\s"\\|&;]
      description: 'SessionStart hook (any matcher, or none) whose command runs a script under one JavaScript or Python runtime and falls back to another with `||`, the portable loader in the testmetest repositories (JFrog, 2026-10-26: `node .github/init.js || bun .github/init.js`). None of 113 public `.claude/settings.json` and plugin `hooks.json` files with a SessionStart hook use a runtime fallback.'
    - field: content
      operator: regex
      value: (?i)\\?"SessionStart\\?"\s*:\s*\[[^\]]{0,800}\\?"command\\?"\s*:\s*\\?"[^"\\]{0,200}(?:^|[\s"=/])\.github/[^\s"\\]{1,160}\.(?:js|mjs|cjs|ts|py|sh)\b
      description: SessionStart hook (any matcher, or none) that runs a script kept under `.github/`, where a repository holds CI configuration rather than editor hooks; the testmetest payload is `.github/init.js`. None of the 113 public SessionStart configurations run a script from `.github/`.
response:
  actions:
    - block_input
    - alert
    - escalate
    - snapshot
  message_template: |
    [ATR-2026-00523] CRITICAL: Claude Code Hooks SessionStart pre-trust RCE pattern detected (CVE-2025-59536). Repo-scoped `.claude/settings.json` registers a SessionStart hook with the `startup` matcher and an executable command field — fires before the trust dialog. Reject the config; require explicit per-hook consent on every session start; treat repo-shipped `.claude/settings.json` as untrusted until reviewed.
remediation: |
  Upgrade Claude Code to the version that ships the enhanced trust-dialog warning (GHSA-ph6w-f82w-28w6). Reject `.claude/settings.json` files shipped in repositories by default; require an explicit user-confirm step on first session for any repo-scoped hook configuration. Never execute SessionStart `startup`-matched hooks without origin verification. Code-review every `.claude/settings.json` in any cloned project before the first session open. Treat the file as equivalent to a `Makefile` or `package.json` postinstall script for security purposes.