AI agent vulnerability · Claude Code

CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

highCVSS 4.0 8.5GHSA-j4h9-wv2m-wrf7

At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. If an attacker controlled the repository’s Git config (e.g., via a malicious .git/config) and set user.email to a crafted payload, the unescaped interpolation could trigger arbitrary command execution before the user accepted the workspace-trust dialog.

Published Sep 10, 2025 · Updated Sep 25, 2025

Affected packages

@anthropic-ai/claude-code

Ecosystem: npm
Affected: < 1.0.105
Fixed in: 1.0.105
Check: npm ls @anthropic-ai/claude-code

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. If an attacker controlled the repository’s Git config (e.g., via a malicious .git/config) and set user.email to a crafted payload, the unescaped interpolation could trigger arbitrary command execution before the user accepted the workspace-trust dialog. The issue affects versions prior to 1.0.105. The fix in 1.0.105 avoids executing commands built from untrusted configuration and properly validates/escapes inputs.

Patches: Update to @anthropic-ai/claude-code 1.0.105 or later.
Workarounds: Open only trusted workspaces and inspect repository .git/config before launch; avoid inheriting untrusted Git configuration values.

Thank you to the NVIDIA AI Red Team for reporting this issue!

Credited to cai0duque.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Claude Code vulnerabilities

All Claude Code entries