Executive brief
Claude Code is a command-line tool used by developers to interact with AI for coding tasks. A security flaw in how the tool determines if a folder is 'trusted' could allow a malicious actor to bypass safety warnings. If a user clones a specially crafted repository and runs Claude Code within it, the tool may automatically execute malicious commands (hooks) without the user's permission, potentially leading to a full system compromise.
Technical details
A vulnerability exists in Claude Code's folder trust logic due to improper validation of the Git worktree 'commondir' file. An attacker can craft a malicious repository containing a 'commondir' file that points to a directory path the victim has previously marked as trusted. When the victim runs Claude Code in the malicious repository, the tool incorrectly inherits the trust status of the spoofed path, bypassing the trust confirmation dialog. This allows the immediate execution of arbitrary shell hooks defined in the repository's '.claude/settings.json' file. Exploitation requires the victim to clone the repository and execute the tool, and the attacker must successfully guess a previously trusted path on the victim's machine. The issue is resolved in version 2.1.84.
Affected products
- Anthropic Claude Code 2.1.63 through 2.1.83
Timeline
- 2026-04-24: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fix released in version 2.1.84