Arbitrary Code Execution in Claude Code by Anthropics
CVE-2025-59041

8.7HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
10 September 2025

What is CVE-2025-59041?

Claude Code, an agentic coding tool developed by Anthropics, has a vulnerability that allows for arbitrary code execution due to a maliciously configured user email within git. When the application starts, it executes code based on this email configuration before the user can accept the workspace trust dialog. This issue impacts versions prior to 1.0.105. Users utilizing the standard auto-update feature of Claude Code will have received the necessary fix automatically. Those updating manually are strongly encouraged to upgrade to version 1.0.105 or the most recent version to mitigate this risk.

Affected Version(s)

claude-code < 1.0.105

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59041 : Arbitrary Code Execution in Claude Code by Anthropics