CVE-2025-59041: Claude Code arbitrary code execution via git config email

# CVE-2025-59041: Claude Code arbitrary code execution via git config email

https://gcdradar.vercel.app/incidents/cve-2025-59041-claude-code-arbitrary-code-execution-via-git · AIR-2025-0333 · closed 2025-09-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-09-10
- AI role: Attack on AI
- Products: Claude Code
- CVE ids: CVE-2025-59041
- CVSS: 8.5

## Summary

An unescaped shell command interpolation in Claude Code allowed arbitrary command execution when parsing a malicious git email configuration. The issue was addressed in version 1.0.105.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-09-10: CVE-2025-59041: Claude Code is an agentic coding tool. (https://nvd.nist.gov/vuln/detail/CVE-2025-59041)
- 2025-09-10: CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email  (https://github.com/advisories/GHSA-j4h9-wv2m-wrf7)

## Sources

- 2025-09-10 GitHub Advisory Database: CVE-2025-59041: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email  https://github.com/advisories/GHSA-j4h9-wv2m-wrf7
- 2025-09-10 NVD: CVE-2025-59041: Claude Code is an agentic coding tool. https://nvd.nist.gov/vuln/detail/CVE-2025-59041

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.