CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.
Other sources
Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it.
Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.
Thank you to hackerone.com/metnew for reporting this issue.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@anthropic-ai/claude-codeto a version that resolves this vulnerability.Fixed in 2.1.163 - Upgrade
Upgrade
Claude Codeto a version that resolves this vulnerability.Fixed in 2.1.163
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55607?
CVE-2026-55607 has a high severity rating of 7.7 according to the CVSS scoring system.
How do I fix CVE-2026-55607?
To address CVE-2026-55607, update Claude Code to version 2.1.164 or later to mitigate the vulnerability.
What is the impact of CVE-2026-55607?
CVE-2026-55607 allows an attacker to execute unsandboxed code due to path confusion in the Git worktree handling.
Which versions of Claude Code are affected by CVE-2026-55607?
CVE-2026-55607 affects Claude Code versions from 2.1.38 to 2.1.163.
Can CVE-2026-55607 lead to data exposure?
Yes, exploiting CVE-2026-55607 can enable attackers to access sensitive data by executing code outside of the intended sandbox.