AI Threat Alert
Claude Code's git worktree handling let a specially crafted repository create a worktree literally named ".git" and navigate outside its intended sandbox context, and by combining that with symlink manipulation and git's fsmonitor hook execution, an attacker could overwrite files in the user's home directory — including shell startup files like .zshenv — to execute code outside the tool's seatbelt sandbox. This matters because Claude Code is an agentic coding assistant developers run directly against untrusted repositories, so a sandbox escape here converts a routine "clone and analyze" workflow into arbitrary code execution on the developer's machine; the flaw is not in CISA KEV, has no known public exploit or Nuclei template, and EPSS sits at a low 0.00765 (top-48th percentile), indicating no evidence of active mass exploitation. Exploitation is not trivial to weaponize at scale — it requires the victim to clone a malicious repository containing prompt injection content and knowingly run Claude Code against it — but that is a realistic scenario for supply-chain-style attacks targeting developers who audit or extend unfamiliar codebases with AI agents. Patch immediately by upgrading to Claude Code 2.1.163 or later; until upgraded, avoid running Claude Code unattended against unvetted or third-party repositories, and audit shell/dotfile integrity (.zshenv, .bashrc, .profile) if any pre-patch version was used against an untrusted repo. Given this is CVE #18 for this package, treat claude-code as a component requiring an active patch-management cadence, not a one-time install.
What is the risk?
High severity given the impact (full code execution outside the tool's sandboxing model, chaining path traversal, link following, and OS command injection weaknesses), but exploitation likelihood is currently low: EPSS is 0.00765 (top 48th percentile, not a high absolute probability), the flaw is absent from CISA KEV, and no public exploit code or scanner template exists yet. The attack requires social engineering (a victim must clone a malicious repository and run Claude Code against it) and a prompt injection component to reliably trigger, which raises the bar versus a fully remote, unauthenticated exploit. However, the package itself carries 17 other CVEs, suggesting a broader pattern of security debt in worktree/sandbox handling that should keep this on a security team's radar for future variants.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Claude Code | npm | >= 2.1.38, < 2.1.163 | 2.1.163 |
| Claude Code | npm | — | No patch |
How severe is it?
What should I do?
1 step-
1) Upgrade @anthropic-ai/claude-code to 2.1.163 or later immediately — this is the only complete fix. 2) Until upgraded, do not run Claude Code unattended/autonomously against repositories from untrusted or unknown sources; review repository contents (especially any embedded instructions in README, comments, or config files) before agentic execution. 3) Avoid running Claude Code with elevated trust against repos that could contain a directory or worktree literally named ".git" or unusual symlinks. 4) Detection: audit modification timestamps and integrity of shell startup dotfiles (~/.zshenv, ~/.bashrc, ~/.profile) on developer workstations that ran pre-2.1.163 Claude Code against external repositories; unexpected changes to these files are a strong indicator of exploitation. 5) Pin and track the claude-code package version in dependency management given its history of 17 CVEs, and subscribe to the GitHub Security Advisories feed (GHSA-7835-87q9-rgvv) for this package.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55607?
Claude Code's git worktree handling let a specially crafted repository create a worktree literally named ".git" and navigate outside its intended sandbox context, and by combining that with symlink manipulation and git's fsmonitor hook execution, an attacker could overwrite files in the user's home directory — including shell startup files like .zshenv — to execute code outside the tool's seatbelt sandbox. This matters because Claude Code is an agentic coding assistant developers run directly against untrusted repositories, so a sandbox escape here converts a routine "clone and analyze" workflow into arbitrary code execution on the developer's machine; the flaw is not in CISA KEV, has no known public exploit or Nuclei template, and EPSS sits at a low 0.00765 (top-48th percentile), indicating no evidence of active mass exploitation. Exploitation is not trivial to weaponize at scale — it requires the victim to clone a malicious repository containing prompt injection content and knowingly run Claude Code against it — but that is a realistic scenario for supply-chain-style attacks targeting developers who audit or extend unfamiliar codebases with AI agents. Patch immediately by upgrading to Claude Code 2.1.163 or later; until upgraded, avoid running Claude Code unattended against unvetted or third-party repositories, and audit shell/dotfile integrity (.zshenv, .bashrc, .profile) if any pre-patch version was used against an untrusted repo. Given this is CVE #18 for this package, treat claude-code as a component requiring an active patch-management cadence, not a one-time install.
Is CVE-2026-55607 actively exploited?
No confirmed active exploitation of CVE-2026-55607 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55607?
1) Upgrade @anthropic-ai/claude-code to 2.1.163 or later immediately — this is the only complete fix. 2) Until upgraded, do not run Claude Code unattended/autonomously against repositories from untrusted or unknown sources; review repository contents (especially any embedded instructions in README, comments, or config files) before agentic execution. 3) Avoid running Claude Code with elevated trust against repos that could contain a directory or worktree literally named ".git" or unusual symlinks. 4) Detection: audit modification timestamps and integrity of shell startup dotfiles (~/.zshenv, ~/.bashrc, ~/.profile) on developer workstations that ran pre-2.1.163 Claude Code against external repositories; unexpected changes to these files are a strong indicator of exploitation. 5) Pin and track the claude-code package version in dependency management given its history of 17 CVEs, and subscribe to the GitHub Security Advisories feed (GHSA-7835-87q9-rgvv) for this package.
What systems are affected by CVE-2026-55607?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, coding agent / developer tooling.
What is the CVSS score for CVE-2026-55607?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.005 AI Agent Tool AML.T0011 User Execution AML.T0051.001 Indirect AML.T0053 AI Agent Tool Invocation AML.T0105 Escape to Host Compliance Controls Affected
What are the technical details?
Original Advisory
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.
Exploitation Scenario
An attacker publishes or contributes to a git repository containing hidden prompt injection content (e.g., in a README, code comment, or config file) designed to manipulate an AI coding agent's behavior. A developer clones this repository and runs Claude Code against it to review or extend the code. The injected content steers Claude Code's agentic tool calls into creating a worktree named ".git" and manipulating symlinks during worktree operations; this triggers execution of git's fsmonitor hook in a way that escapes the tool's intended sandbox/worktree boundary. The attacker uses this to write into the developer's home directory, overwriting a shell startup file such as .zshenv with malicious commands. The next time the developer opens a terminal shell, the attacker's code executes with the developer's full local privileges — completely outside Claude Code's seatbelt sandbox restrictions — enabling credential theft, lateral movement, or further supply-chain compromise.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-59 Improper Link Resolution Before File Access ('Link Following')
Primary
CWE-59 Improper Link Resolution Before File Access ('Link Following')
Primary
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Primary
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59 Improper Link Resolution Before File Access ('Link Following') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-2611 9.6 MLflow: cross-origin bypass enables RCE via AI agent
Same package: claude-code CVE-2026-7574 8.7 Claude Desktop: VM integrity bypass enables RCE
Same package: claude-code CVE-2026-35020 8.4 Claude Code CLI: OS command injection via TERMINAL env
Same package: claude-code CVE-2026-49471 8.3 Serena: unauth dashboard API enables RCE via memory poisoning
Same package: claude-code CVE-2026-44246 7.2 nnU-Net: prompt injection hijacks CI/CD triage agent
Same package: claude-code