Executive brief
Claude Code is a development tool that executes shell commands during startup to configure the development environment. An attacker can place a malicious Git configuration file in a repository to execute arbitrary code before the user is prompted to trust the workspace, potentially compromising system security and user data.
Technical details
The vulnerability is a command injection flaw (CWE-78, CWE-94) in Claude Code's startup sequence. At initialization, the application constructs a shell command by directly interpolating the git config user.email value without proper escaping or validation. An attacker who controls a repository's .git/config file can set user.email to a crafted payload containing shell metacharacters to achieve arbitrary code execution. The attack occurs before the user-trust dialog is presented, bypassing that security control. The local attack vector requires the user to open a malicious repository, but no elevated privileges are required. Patches are available in version 1.0.105 and later.
Affected products
- Anthropic Claude Code prior to 1.0.105
Timeline
- 2025-09-10: disclosed
- 2025-09-10: patched: Version 1.0.105 released