High · published September 10, 2025
⚡ A crafty email setting in Git can trigger code execution before you even hit "trust" on Claude Code! 😱 Think of it like a sneaky chef slipping a surprise ingredient into your meal before you've even taken a bite — you might end up with a recipe you never intended! This vulnerability could allow a malicious actor to execute arbitrary code on your system, effectively hijacking your coding environment and potentially compromising sensitive data. If you're working on critical projects, this could lead to unauthorized access, data loss, or even full system takeovers!
Think of it like a sneaky chef slipping a surprise ingredient into your meal before you've even taken a bite — you might end up with a recipe you never intended! The issue resides in Claude Code's startup sequence, where it executes commands based on the `git config user.email` setting. Prior to version 1.0.105, a maliciously crafted email could lead to arbitrary code execution without any user intervention.
This vulnerability could allow a malicious actor to execute arbitrary code on your system, effectively hijacking your coding environment and potentially compromising sensitive data. If you're working on critical projects, this could lead to unauthorized access, data loss, or even full system takeovers! If you're using Claude Code, make sure to update to version 1.0.105 or later immediately. If you're on auto-update, you're in the clear! For those who update manually, check your version now and upgrade as necessary to secure your environment. You've got this! Follow these steps, and your coding playground will be safe and sound. 🛡️