CVE-2025-59041
📋 TL;DR
CVE-2025-59041 is a critical remote code execution vulnerability in Claude Code where malicious git user.email configuration could execute arbitrary commands before workspace trust dialog acceptance. This affects all Claude Code users with versions before 1.0.105. The vulnerability allows attackers to run code with the privileges of the Claude Code process.
💻 Affected Systems
- Claude Code
📦 What is this software?
Claude Code by Anthropic
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands, install malware, steal credentials, and pivot to other systems.
Likely Case
Local privilege escalation or execution of malicious scripts when users open projects with malicious git configurations.
If Mitigated
No impact if patched to version 1.0.105+ or if proper git configuration controls are enforced.
🎯 Exploit Status
Exploitation requires user to open a project with malicious git configuration, but no user interaction beyond opening the project.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.105
Vendor Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7
Restart Required: Yes
Instructions:
1. Open Claude Code. 2. Go to Settings > Updates. 3. Click 'Check for Updates'. 4. Install version 1.0.105 or later. 5. Restart Claude Code.
🔧 Temporary Workarounds
Disable automatic git config loading
allPrevent Claude Code from loading git configurations at startup
git config --global claude.code.gitConfig false
Sanitize git user.email configuration
allEnsure git user.email contains only valid email addresses
git config --global user.email "your-email@example.com"
git config --global --unset-all user.email
git config --global --add user.email "your-email@example.com"
🧯 If You Can't Patch
- Restrict git configuration permissions to prevent malicious user.email settings
- Use Claude Code only with trusted repositories and verify git configurations before opening
🔍 How to Verify
Check if Vulnerable:
Check Claude Code version in Settings > About. If version is below 1.0.105, you are vulnerable.Check Version:
claude-code --versionVerify Fix Applied:
Verify version is 1.0.105 or higher in Settings > About. Test by setting a test git user.email and confirming no command execution.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from Claude Code startup
- Git configuration parsing errors
- Commands containing shell metacharacters in git config logs
Network Indicators:
- Unusual outbound connections from Claude Code process at startup
SIEM Query:
process_name:"Claude Code" AND (command_line:*git* OR parent_process:git) AND event_type:"process_start"