CVE-2025-59041

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

State: Published
Severity: 8.7 High
Published: Sep 10, 2025
Updated: Oct 15, 2025
Reserved: Sep 8, 2025

Description

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
claude-codeanthropics	< 1.0.105Affected

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.