Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Claude Code runs commands based on your git email settings without checking them first. An attacker could set a malicious email in git configuration to run harmful code on your computer before you even open a project.

Claude Code unsafely executes templated commands derived from `git config user.email` at startup before workspace trust validation occurs. An attacker with local git repository write access can inject arbitrary shell commands via a malicious email configuration, achieving code execution with the privileges of the Claude Code process prior to user consent mechanisms.