CVE-2025-59041
Published: 10 September 2025
Summary
CVE-2025-59041 is a critical-severity Code Injection (CWE-94) vulnerability in Anthropic Claude Code. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 44.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the code injection flaw in Claude Code prior to version 1.0.105 to prevent arbitrary command execution from malicious git config user.email.
Mandates validation of untrusted inputs such as git config user.email output before templating into commands, directly blocking code injection exploits.
Ensures receipt and implementation of vendor security advisories like the Anthropic GHSA for CVE-2025-59041, enabling prompt flaw remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables client-side arbitrary command execution via malicious git config injection at startup (T1203) and directly facilitates Unix shell command execution (T1059.004).
NVD Description
Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before…
more
a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.
Deeper analysisAI
CVE-2025-59041 is a code injection vulnerability (CWE-94) affecting Claude Code, an agentic coding tool developed by Anthropic. The issue arises at startup, where Claude Code executes a command templated with the output of `git config user.email`. In versions prior to 1.0.105, a maliciously configured user.email in a Git repository could trigger arbitrary code execution before the user accepts the workspace trust dialog. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
An attacker can exploit this vulnerability remotely with no privileges or user interaction required beyond the victim launching Claude Code in a workspace tied to a malicious Git repository. By configuring a Git repository's user.email to contain malicious command injection payloads, an attacker could entice a user to clone or open the repository, leading to arbitrary code execution on the victim's local system during Claude Code startup, prior to any trust confirmation.
The security advisory at https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7 recommends updating to version 1.0.105 or later to mitigate the issue. Users on standard auto-update channels will receive the fix automatically, while those using manual updates are advised to apply the patch promptly.
Details
- CWE(s)