CVE-2025-59041 is a critical (CVSS 9.8) code execution flaw in Claude Code, the agentic coding tool. At startup it ran a command that included the git user email, so a malicious value could execute code before the workspace trust dialog was accepted. Versions before 1.0.105 are affected.
What's affected
Claude Code versions before 1.0.105, per the record and the GitHub advisory. The fixed version is 1.0.105.
Users on standard auto-update received the fix automatically. The advisory credits the NVIDIA AI Red Team.
The behavior happened at startup, before the user accepted the workspace trust dialog.
How to check if you're exposed
Claude Code ships as an npm package, so check the version directly.
claude --version
npm ls -g @anthropic-ai/claude-code
Anything below 1.0.105 is affected. The advisory says users on standard auto-update received the fix automatically, so the people most likely to be behind are those who pin versions or update by hand, including build images and shared development containers.
Also look at the git user email configured in repositories you did not create. A value that contains shell punctuation or looks like a command rather than an address is worth removing.
git config --show-origin --get-all user.email
What to do now
- Run the claude version command on developer machines, CI images and dev containers, and update anything below 1.0.105.
- Review repository level git configuration in repositories from outside sources before opening them with any tool.
- Do not run agentic tools in a repository you have not looked at, especially with elevated privileges.
- Run developer tools in disposable containers when you inspect untrusted code.
Why it matters
Workspace trust dialogs exist so that opening a folder does not mean running its contents. The flaw was ordering: a command built from a git setting ran at startup before the user decided whether to trust the workspace. A value an attacker controls, delivered through repository configuration, was enough to run commands.
The weakness is code injection, where data is treated as part of a command. Anything that builds a shell command from configuration values needs careful quoting or, better, avoids the shell entirely.
The record classifies the weakness as CWE-94 (Code Injection).
Trust prompts only work if nothing risky happens before them. When you review any tool that opens untrusted projects, ask what it reads and runs before the prompt appears, because that is where this class of bug lives.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Why does the trust dialog matter here?
It is meant to stop untrusted projects from running code. In affected versions the command ran before the dialog was accepted.
Which version fixes it?
Claude Code 1.0.105.
Sources
Last reviewed: 18 October 2026.
