CVE-2026-55607: Claude Code Sandbox Escape via Git Worktree Path Traversal

Technical summary

The vulnerability involves a combination of three core weaknesses: path traversal (CWE-22), improper link resolution before file access (CWE-59), and improper neutralization of special elements in command execution (CWE-78). Claude Code's worktree handling between versions 2.1.38 and 2.1.162 failed to properly validate worktree names and locations, permitting creation of worktrees with names like ".git". By manipulating symlinks and leveraging git fsmonitor execution during worktree setup operations, an attacker can navigate to paths outside the sandbox context and write files to arbitrary locations in the user's home directory. The attack chain requires the user to interact with a malicious repository, but once triggered, the sandbox containment mechanism is entirely bypassed, allowing unauthorized code execution at the user's privilege level.

Business impact

This vulnerability directly undermines the security guarantees of Claude Code's sandbox model. Organizations and individual developers using Claude Code to analyze or process code from untrusted sources face a critical risk of machine compromise. Successful exploitation grants an attacker full code execution on the developer's workstation, potentially enabling data theft (source code, credentials, SSH keys), installation of persistence mechanisms, lateral movement within corporate networks, and supply chain attacks if the compromised machine is used to commit or deploy software. The requirement for user interaction (cloning a malicious repository) makes it a realistic attack vector in collaborative development environments where developers may clone repositories from internal or external sources without deep vetting.

Affected systems

Claude Code versions 2.1.38 through 2.1.162 are vulnerable. Version 2.1.163 and later contain the fix. Any organization or developer running Claude Code within the affected version range should immediately assess their deployment. The vulnerability affects all platforms that Claude Code supports, as the underlying worktree handling logic is platform-agnostic. Users should inventory Claude Code installations across their environment, including local development machines, CI/CD environments, and any automation integrating Claude Code.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with a vector indicating low attack complexity and no privileges required, though user interaction is mandatory. The attack does not require the attacker to have prior access to the target system; however, the user must actively clone a repository and invoke Claude Code against it. This is a realistic interaction pattern in development workflows. The barrier to exploitation is moderate: an attacker must craft a repository with malicious prompt injection content and convince a developer to process it with Claude Code, but no zero-click exploitation or social engineering complexity is required beyond the natural act of repository cloning. The fix is cleanly available, reducing the window of practical risk for organizations that can deploy updates promptly.

Remediation

Upgrade Claude Code to version 2.1.163 or later immediately. This version resolves the worktree handling defects that permit path traversal and sandbox escape. Additionally, organizations should: audit logs and filesystem activity on machines running affected versions to detect indicators of compromise (unexpected modifications to shell configuration files like .zshenv, .bashrc, or .profile); apply the principle of least privilege to developer machines to limit the scope of damage if code execution does occur; and reinforce developer awareness regarding the risks of cloning repositories from untrusted sources. Until patching is complete, consider restricting Claude Code usage to sandboxed environments or machines without sensitive credentials or access to production systems.

Patch guidance

The fix is contained in Claude Code version 2.1.163. Verify your current version by checking the application's about dialog or querying the installation metadata. Deploy the update through Anthropic's official distribution channels. If you use Claude Code in an automated context (e.g., CI/CD pipelines), ensure your deployment automation sources updates from trusted Anthropic repositories and tests the patched version before rolling it out to production pipelines. Organizations with managed Claude Code deployments should coordinate updates with their internal release management process to ensure rapid, verified deployment across all affected systems.

Detection guidance

Monitor for exploitation indicators: (1) Unusual modifications to user home directory shell configuration files (.zshenv, .bashrc, .profile, .bash_profile) with unexpected timestamps or content changes during or immediately after Claude Code execution; (2) Unexpected child processes spawned from Claude Code or git-related operations; (3) Anomalous git fsmonitor activity or unexpected git worktree creation in user project directories; (4) Filesystem access logs showing creation of hidden directories or symlinks within project worktrees; (5) Post-clone activity that involves navigation outside the expected project directory structure. Organizations using endpoint detection and response (EDR) tools should create detection rules triggering on modifications to shell configuration files initiated by Claude Code or git processes, particularly when combined with subsequent privilege escalation or lateral movement attempts.

Why prioritize this

Prioritize patching this vulnerability within your highest-risk tier for the following reasons: (1) the CVSS score of 8.8 reflects high severity with complete integrity, confidentiality, and availability impact; (2) exploitation bypasses sandbox containment, a core security boundary; (3) successful exploitation grants full code execution at user privilege level; (4) the attack vector is network-accessible and exploitation requires only user interaction (cloning a repository), a normal development action; (5) the vulnerability has been publicly disclosed, increasing the likelihood of active exploitation research. While active exploitation in the wild is not yet confirmed (the vulnerability is not listed in CISA's KEV catalog), the low bar to exploitation and the high-value target (developer machines with access to source code and credentials) warrant immediate action.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network Attack Vector (user-initiated interaction with external resources), Low Attack Complexity (straightforward worktree name validation bypasses), No Privilege Required (attacker does not need prior access), Required User Interaction (user must clone and process the malicious repository), Unchanged Scope (sandbox escape remains within the context of the user's machine), and High impact across Confidentiality, Integrity, and Availability (arbitrary code execution). The score appropriately weights the severity of sandbox escape against the requirement for user interaction. The practical risk within your organization depends on adoption breadth, network exposure of development machines, and the maturity of your developer security culture regarding repository vetting.

Frequently asked questions