CVE-2025-59041 HIGH

CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Vendor Anthropics
Product claude-code
Weakness CWE-94 · Code injection
Published September 10, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

Key dates

02Disclosure timeline

September 10, 2025 CVE published
October 15, 2025 Record updated