CVE-2026-40068: Claude Code arbitrary code execution via git worktree commondir trust dialog bypass
Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents. By crafting a repository with a commondir file pointing to a path the victim had previously trusted, an attacker could bypass the trust dialog and immediately execute malicious hooks defined in .claude/settings.json. Exploiting this required the victim to clone a malicious repository and run Claude Code within it, and for the attacker to know or guess a path the victim had already trusted.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/masatoanzai for reporting this issue.
Other sources
In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in .claude/settings.json. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@anthropic-ai/claude-codeto a version that resolves this vulnerability.Fixed in 2.1.84 - Upgrade
Upgrade
Claude Codeto a version that resolves this vulnerability.Fixed in 2.1.84
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40068?
CVE-2026-40068 has a critical severity rating due to the potential for remote code execution.
How do I fix CVE-2026-40068?
To fix CVE-2026-40068, upgrade to the latest version of the @anthropic-ai/claude-code package, specifically version 2.1.84 or later.
What versions of @anthropic-ai/claude-code are affected by CVE-2026-40068?
CVE-2026-40068 affects versions of @anthropic-ai/claude-code between 2.1.63 and 2.1.84, inclusive.
What is the attack vector for CVE-2026-40068?
The attack vector for CVE-2026-40068 involves malicious repositories that exploit the insecure handling of the commondir file to bypass trust validation.
Is CVE-2026-40068 a type of vulnerability that requires user interaction?
CVE-2026-40068 can be exploited without user interaction, as it enables attackers to execute malicious hooks automatically.