Claude Code Arbitrary Code Execution Vulnerability via Malicious Git Email Configuration
Vulnerability
A vulnerability in Claude Code prior to version 1.0.105 allows for arbitrary code execution. This issue arises because, at startup, Claude Code executes a command based on the user's git configuration email. If the email is maliciously crafted, it can trigger code execution before the user has a chance to accept the workspace trust dialog. Users who have updated Claude Code through the standard auto-update process will have received the patch for this vulnerability. Those who update manually should upgrade to version 1.0.105 or the latest version.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the user's machine.
Remediation
Users performing manual updates are advised to update to version 1.0.105 or the latest version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.