CVE-2025-59041

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
anthropics	claude-code	< 1.0.105

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7Vendor Advisory

Timeline

Published: Sep 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590427.0PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path`CVE-2025-590437.5OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use CVE-2025-590444.4Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups f CVE-2025-590457.1Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exist CVE-2025-590469.8The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts f CVE-2025-590472.7matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalize CVE-2025-590488.1OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-a CVE-2025-590497.5Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same CVE-2025-59058.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeate CVE-2025-590507.8Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM CVE-2025-590518.6The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network dev CVE-2025-590527.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular