CVE-2026-55607: a prompt-injected repo could steer Claude Code's worktree tools out of its sandbox

Vulnerability · Claude Code · HIGH

Incident dateNot stated

DisclosedJun 25, 2026 (Anthropic advisory GHSA-7835-87q9-rgvv). NVD published Jun 29, 2026. Fix released Jun 4, 2026 in 2.1.163. Added here as a backfill on Oct 15, 2026.

Added hereOct 15, 9:32 AM ET

Last verifiedOct 15, 2026

Summary

Anthropic fixed CVE-2026-55607 in Claude Code 2.1.163, released Jun 4, 2026, and published advisory GHSA-7835-87q9-rgvv on Jun 25. Versions from 2.1.38 up to 2.1.163 let Claude Code create a worktree named .git and move into worktrees outside the sandboxed folder. A malicious repository with prompt injection in it could use that to confuse git about where its repository folder was, run its own script through git's fsmonitor setting, and overwrite files in the user's home folder such as ~/.zshenv. That gave code execution outside the macOS seatbelt sandbox, even with Claude Code's most restrictive Bash settings. The researcher, Metnew, reported it through Anthropic's HackerOne program and published a full write-up and proof of concept. Users on auto-update already have the fix. This is a backfill: the advisory is from June and is resurfacing on X this week.

Severity

HIGH Anthropic scores it CVSS 4.0 7.7 High; NVD's own CVSS 3.1 score is 8.8 High. The victim has to clone a malicious repository and run Claude Code on it, and the attack relies on prompt injection steering the agent's worktree tools. Neither Anthropic's advisory nor the researcher reports exploitation in the wild.

Timeline

Feb 10, 2026
Claude Code 2.1.38, the first affected version, is published to npm (per npm registry metadata).
May 11, 2026
Metnew reports the issue to Anthropic through HackerOne (per the researcher's write-up).
Jun 4, 2026
Anthropic releases Claude Code 2.1.163, which no longer accepts .git as a worktree name.
Jun 25, 2026
Anthropic publishes advisory GHSA-7835-87q9-rgvv (CVE-2026-55607).
Jun 29, 2026
NVD publishes CVE-2026-55607.

How it happened

Claude Code can create, enter and exit git worktrees with its own tools. The researcher's chain starts with prompt injection in a cloned repo asking Claude to create a worktree called .git, which lands in .claude/worktrees/.git. Because the repo was built to look like a git folder, git commands run from .claude/worktrees then treat that copy as the repository, and its config sets core.fsmonitor to a script that git runs on every status check. Claude Code's worktree tools run git themselves, so the script fires without any extra command being approved. The script then swaps folders for symlinks to the home directory and writes worktree records that point there, so Claude enters a 'worktree' that is really the user's home folder, and the next git call lets the script append to ~/.zshenv. Every later zsh launch, including the ones Claude Code uses to start sandboxed commands, then runs the attacker's line outside the sandbox. Anthropic's advisory lists CWE-22, CWE-59 and CWE-78. The fix stops .git from being used as a worktree name. The researcher demonstrated it on Claude Code 2.1.139 on macOS and says Anthropic fixed it quickly.

How to check your app

Run claude --version and make sure you are on 2.1.163 or later. Auto-updating installs already have the fix.
Look at ~/.zshenv and other shell startup files for lines you did not add, especially if you ran an affected version on repositories you did not write.
Be careful running any coding agent on freshly cloned repositories you do not trust, even with its sandbox turned on.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.