IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-10 16:15

MODIFIED

2025-09-11 17:14

EPSS (Prob. Exploit)

0.55%

Top 55.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-j4h9-wv2m-wrf7 HIGH

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

AFFECTED PACKAGES:

NPM / @anthropic-ai/claude-code

< 1.0.105

Fixed in: 1.0.105

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-j4h9-wv2m-wrf7

> HISTORIQUE DES MODIFICATIONS

Première apparition

10/09/2025 16:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui