On June 29, 2026, GitHub published CVE-2026-55607 — a high-severity (CVSS 8.8) sandbox escape in Anthropic’s Claude Code CLI. The vulnerability lets an attacker craft a malicious repository that, when opened in a vulnerable version of Claude Code, chains together a series of individually plausible git operations into a full sandbox escape and arbitrary code execution on the developer’s host machine. Versions 2.1.38 through 2.1.162 are affected. Version 2.1.163 fixes it.
This is not a theoretical edge case. The exploit was demonstrated against Claude Code running in its most restricted interactive mode — sandbox enabled, Bash not auto-approved, the agent limited to read-only actions. The attacker does not need to convince the user to run a suspicious command. The user just needs to clone a repo and start working.
The attack chain in plain language
The exploit, disclosed by security researcher Metnew, works by arranging five individually legitimate features into a sequence that none of them were designed to handle together. Here is the chain:
Step 1: Repository context injection. The malicious repository contains a CLAUDE.md file with instructions that steer Claude Code toward a specific sequence of git operations. This is prompt injection — the model reads the instructions and follows them because they appear to be legitimate project guidance.
Step 2: A worktree named .git. Claude Code allowed git worktrees to be named .git. In an ordinary project this sounds like a weird edge case. In a malicious repository whose root also looks like a valid git directory (containing HEAD, config, objects/, refs/), this creates a “gitdir confusion” where git starts treating attacker-controlled files as repository metadata.
Step 3: Symlink redirect outside the workspace. The exploit manipulates a path under .claude/worktrees so it resolves through a symlink into the user’s home directory. From git’s perspective, the destination still appears to be a valid worktree. From the filesystem’s perspective, the resolved target has moved outside the project boundary entirely.
Step 4: core.fsmonitor executes attacker code. Git’s fsmonitor feature lets repository configuration specify a custom command to enumerate changed files. Once the worktree layout is manipulated, the malicious fsmonitor setting activates. Every worktree operation — enter, exit, status — advances a staged payload. This runs with the user’s full privileges, outside the sandbox.
Step 5: ~/.zshenv overwrite breaks the sandbox. The payload’s final move is writing to ~/.zshenv. On macOS, zsh reads this file before the seatbelt sandbox profile is applied to the next command Claude Code launches. The planted code executes in the host context. The proof of concept opened Calculator. A real attacker could do anything the user can do.
Why this is worse than a typical prompt injection
Prompt injection against a chatbot means the model says the wrong thing. Prompt injection against a coding agent means the model does the wrong thing — it operates machinery. CVE-2026-55607 chains prompt injection with five classical software vulnerabilities:
| Layer | Failure |
|---|---|
| Repository context | Attacker-controlled CLAUDE.md enters the model’s reasoning |
| Worktree validation | The reserved name .git is accepted as a worktree name |
| Path handling | Symlinks redirect the worktree root outside the project |
| Git execution | Attacker-controlled fsmonitor runs arbitrary commands |
| Shell startup | .zshenv executes before the seatbelt sandbox engages |
None of these components is broken in isolation. Git trusts its repository configuration. Claude Code trusts project instructions enough to operate git tools. Worktrees interact with symlinks. Shell startup files execute before sandbox profiles. Each behavior is individually reasonable. Composed together, they form a path from untrusted text in a README to code execution on your machine.
Who is affected
Affected versions: Claude Code CLI versions 2.1.38 through 2.1.162. This includes the npm package @anthropic-ai/claude-code.
What you need to exploit it: A victim must clone a malicious repository and run Claude Code against it in an affected version. The repository must contain prompt injection content that successfully guides the agent through the required worktree operations. Social engineering is required (convincing a developer to clone and open the repo), but the user does not need to approve an obviously malicious command — the agent is guided through “normal” development operations.
CVSS scores:
- NVD CVSS v3.1: 8.8 (High) — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- GitHub CVSS v4.0: 7.7 (High)
CWEs: CWE-22 (Path Traversal), CWE-59 (Improper Link Resolution), CWE-78 (OS Command Injection)
The fix
Anthropic fixed CVE-2026-55607 in Claude Code version 2.1.163 by rejecting .git as a valid worktree name. This closes the reported exploit chain. The advisory is published at GHSA-7835-87q9-rgvv.
Upgrade immediately if you are running any version in the 2.1.38–2.1.162 range:
npm update -g @anthropic-ai/claude-code
# or
npm install -g @anthropic-ai/claude-code@latestVerify your version:
claude --version
# Should show 2.1.163 or higherTemporary mitigations if you cannot upgrade yet
If upgrading immediately is not possible (enterprise rollout cycles, locked-down environments), these steps reduce your exposure:
# Disable fsmonitor globally — closes the execution sink
git config --global core.fsmonitor false
# Audit recently cloned repos for symlinks pointing outside the tree
find . -type l -exec readlink -f {} \; 2>/dev/null | grep -v "$(pwd)"
# Check for git worktrees named .git
git worktree list | grep '\.git$'
# Inspect shell startup files for unexpected modifications
ls -la ~/.zshenv ~/.zshrc ~/.bashrc ~/.bash_profile
# Compare timestamps to your last known-good state
stat ~/.zshenvHow to detect if you were already hit
If you used a vulnerable version of Claude Code with any untrusted or externally sourced repository, check for indicators of compromise:
# Look for worktrees named .git (the attack primitive)
git worktree list 2>/dev/null | grep '\.git$' && echo "ALERT: .git worktree found"
# Check shell startup files for unexpected content
grep -n 'curl\|wget\|exec\|eval\|python\|node' ~/.zshenv ~/.zshrc ~/.bashrc ~/.bash_profile 2>/dev/null
# Find symlinks in cloned repos that point outside the project
find ~/projects -maxdepth 4 -type l -exec sh -c 'target=$(readlink -f "$1"); case "$target" in "$(dirname "$1")"/*) ;; *) echo "OUTSIDE: $1 -> $target" ;; esac' _ {} \; 2>/dev/null
# Check git config for suspicious fsmonitor settings
git config --global --get core.fsmonitorAny of these findings on a system where you ran a vulnerable Claude Code version against an untrusted repo warrants investigation.
The broader lesson for coding agent security
CVE-2026-55607 is not just a Claude Code problem. It is a demonstration of how AI coding agents compose trust boundaries in ways that differ fundamentally from traditional software.
Traditional software reads configuration, validates it against expected patterns, and executes. A coding agent reads untrusted text (project instructions, commit messages, README files), reasons about what to do, and then executes — using tools that interact with the OS, git, filesystem, and shell in ways that traditional software never did. The attack surface is not just the agent’s code. It is the agent’s reasoning combined with every tool and system call available to it.
The researcher who found this vulnerability put it well: “AI agent tools need threat models closer to browsers and package managers than to plain chatbots.” Any feature that reads project-local instructions, runs git, follows symlinks, manages worktrees, or launches shells is part of the attack surface. Sandboxing has to wrap the real execution boundary — including shell startup, git helpers, hooks, config-driven commands, and filesystem pivots.
For teams evaluating coding agents, this CVE is a data point in the security maturity conversation:
- Does the agent’s sandbox cover the full execution boundary? Not just the Bash command itself, but shell startup files, git operations, and filesystem operations that happen around the command.
- Does the agent validate tool inputs against adversarial shapes? Worktree names, file paths, symlink targets — these are not just convenience features, they are trust boundaries.
- Does the agent distinguish between repository content and system-level operations? A
CLAUDE.mdfile is text in a repo. But when the agent treats it as instructions and acts on them using system tools, the trust model changes.
What to do right now
- Upgrade to Claude Code 2.1.163 or later. This is the only complete fix.
- If you cannot upgrade immediately, disable
core.fsmonitorglobally and audit recently cloned repos for the indicators described above. - Treat untrusted repositories as hostile input until you have reviewed their contents — especially any files that look like they instruct the agent (
.claude/,CLAUDE.md,.cursorrules,.github/copilot-instructions.md). - Monitor shell startup files (
.zshenv,.zshrc,.bashrc,.bash_profile) for unexpected modifications, especially after sessions where Claude Code processed external repositories. - Revoke and rotate any credentials accessible from the affected user account if you confirm the exploit was triggered.
This vulnerability reinforces a pattern we have seen repeatedly across coding agents — including the v2.1.212 worktree symlink fix we covered last week: the security boundary is not where most users think it is. The sandbox is not just the box around the Bash command. It is the entire trust chain from the moment untrusted text enters the model’s context to the moment a process exits on your machine. CVE-2026-55607 exploited every link in that chain.
Don’t overpay for AI tools. Check aiFiesta for exclusive pricing on coding agents.