# CVE-2025-59041: Anthropic Claude Code arbitrary code execution in git configuration

Source: https://junglewise.ai/threats/cve-2025-59041-anthropic-claude-code-arbitrary-code-execution-in-git  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59041 · Severity: medium · CVSS 4 · Published 2025-09-10

Claude Code is a development tool that executes shell commands during startup to configure the development environment. An attacker can place a malicious Git configuration file in a repository to execute arbitrary code before the user is prompted to trust the workspace, potentially compromising system security and user data.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-59041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59041 being exploited in the wild.

**How severe is CVE-2025-59041?** Medium severity, with a CVSS score of 4, published 10 September 2025.

**Which products and versions are affected?** Anthropic Claude Code prior to 1.0.105; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=1.0.105.

**Is there a fix for CVE-2025-59041?** Yes. @anthropic-ai/claude-code (npm): upgrade to 1.0.105 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59041 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-59041?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 1.0.105 or later

  ```sh
  npm install @anthropic-ai/claude-code@1.0.105
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-78, CWE-94) in Claude Code's startup sequence. At initialization, the application constructs a shell command by directly interpolating the git config user.email value without proper escaping or validation. An attacker who controls a repository's .git/config file can set user.email to a crafted payload containing shell metacharacters to achieve arbitrary code execution. The attack occurs before the user-trust dialog is presented, bypassing that security control. The local attack vector requires the user to open a malicious repository, but no elevated privileges are required. Patches are available in version 1.0.105 and later.

## Affected products

- Anthropic Claude Code prior to 1.0.105

## Identifiers

- CVE-2025-59041
- GHSA-j4h9-wv2m-wrf7

## Timeline

- 2025-09-10: disclosed
- 2025-09-10: patched: Version 1.0.105 released

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7](https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)