Vulnerability Intelligence Report
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
CVE-2025-59041
Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.51%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Threat Intelligence Signals
EPSS Score
0.508%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2025-09-08T16:19:26 |
| Published | 2025-09-10T15:07:50 |
| Last Updated | 2025-10-15T16:00:49 |
Community Chatter & Buzz