CVE Feed

    Dashboard / CVE / CVE-2025-59041

    CVE-2025-59041

    Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

    Published:Sep 10, 2025
    Last Modified:Oct 22, 2025
    EPS:Sep 10, 2025
    EPSS Score:0.00112
    CVSS Score:9.8

    Affected Products

    Vendor
    Anthropic
    Product
    Claude Code
    Vendor
    Anthropics
    Product
    Claude Code

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-40068 (CVSS 7.7) — In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree c…
    CVE-2026-39861 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxe…
    CVE-2026-35603 (CVSS 5.4) — Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-w…
    CVE-2026-35022 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavio…
    CVE-2026-35021 — This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the affected code p…
    CVE-2026-35020 — This CVE ID has been rejected by the its CVE Numbering Authority (CNA). It was determined that the attack requ…
    CVE-2026-33068 (CVSS 7.7) — Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings fil…
    CVE-2026-25725 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism f…
    CVE-2026-25724 (CVSS 2.3) — Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rul…
    CVE-2026-25723 (CVSS 7.7) — Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate comman…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High