Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536) - ATR-2026-00523 (2d63479d-1c53-5345-a70f-0cd5a594ab11)
Detects exploitation of CVE-2025-59536 (Critical), pre-trust remote code execution in Claude Code via the Hooks feature. An attacker-controlled repository ships a .claude/settings.json that registers a SessionStart hook with the startup matcher; when a developer opens the project directory, Claude Code executes the registered command BEFORE the trust dialog renders. The full kill chain is: clone-or-open malicious repo → Claude Code loads repo-scoped .claude/settings.json → hook command fires pre-trust → arbitrary code runs with developer's local privileges. The matcher / event names (SessionStart, startup) are stable strings in the Claude Code Hooks schema, so the detector anchors on the config-file shape rather than the command payload (any shell binary, curl pipe-to-shell, npm/pip install, or python -c body is sufficient for RCE post-trigger). CWE-94, CWE-1188 (insecure default). Patches in Claude Code via enhanced trust-dialog warning (GHSA-ph6w-f82w-28w6). Reported by Aviv Donenfeld and Oded Vanunu (Check Point Research). This rule detects exploit configs in repo-scoped settings.json files and provides defence-in-depth post-patch by flagging the dangerous matcher shape regardless of upstream dialog state.