Is CVE-2025-59041 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59041 being exploited in the wild.

How severe is CVE-2025-59041?

Medium severity, with a CVSS score of 4, published 10 September 2025.

Which products and versions are affected?

Anthropic Claude Code prior to 1.0.105; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.105.

Is there a fix for CVE-2025-59041?

Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.105 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-59041 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-59041?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59041: Anthropic Claude Code arbitrary code execution in git configuration

CVE-2025-59041 · Severity: medium · CVSS 4 · Published 2025-09-10

Claude Code is a development tool that executes shell commands during startup to configure the development environment. An attacker can place a malicious Git configuration file in a repository to execute arbitrary code before the user is prompted to trust the workspace, potentially compromising system security and user data.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2025-59041 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59041 being exploited in the wild.
How severe is CVE-2025-59041?: Medium severity, with a CVSS score of 4, published 10 September 2025.
Which products and versions are affected?: Anthropic Claude Code prior to 1.0.105; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.105.
Is there a fix for CVE-2025-59041?: Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.105 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59041 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-59041?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 1.0.105 or later
```
npm install @anthropic-ai/claude-code@1.0.105
```

Technical details

The vulnerability is a command injection flaw (CWE-78, CWE-94) in Claude Code's startup sequence. At initialization, the application constructs a shell command by directly interpolating the git config user.email value without proper escaping or validation. An attacker who controls a repository's .git/config file can set user.email to a crafted payload containing shell metacharacters to achieve arbitrary code execution. The attack occurs before the user-trust dialog is presented, bypassing that security control. The local attack vector requires the user to open a malicious repository, but no elevated privileges are required. Patches are available in version 1.0.105 and later.

Affected products

Anthropic Claude Code prior to 1.0.105

Identifiers

CVE-2025-59041
GHSA-j4h9-wv2m-wrf7

Timeline

2025-09-10: disclosed
2025-09-10: patched: Version 1.0.105 released

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.