CVE-2026-40068: Anthropic Claude Code trust bypass via Git worktree spoofing

CVE-2026-40068 · Severity: high · CVSS 8.8 · Published 2026-05-05

Claude Code is a command-line tool used by developers to interact with AI for coding tasks. A security flaw in how the tool determines if a folder is 'trusted' could allow a malicious actor to bypass safety warnings. If a user clones a specially crafted repository and runs Claude Code within it, the tool may automatically execute malicious commands (hooks) without the user's permission, potentially leading to a full system compromise.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-40068 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40068 being exploited in the wild.
How severe is CVE-2026-40068?
High severity, with a CVSS score of 8.8, published 5 May 2026.
Which products and versions are affected?
Anthropic Claude Code 2.1.63 through 2.1.83; @anthropic-ai/claude-code (npm) SEMVER:introduced=2.1.63,fixed=2.1.84.
Is there a fix for CVE-2026-40068?
Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.84 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40068 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40068?
Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 2.1.84 or later
    npm install @anthropic-ai/claude-code@2.1.84

Technical details

A vulnerability exists in Claude Code's folder trust logic due to improper validation of the Git worktree 'commondir' file. An attacker can craft a malicious repository containing a 'commondir' file that points to a directory path the victim has previously marked as trusted. When the victim runs Claude Code in the malicious repository, the tool incorrectly inherits the trust status of the spoofed path, bypassing the trust confirmation dialog. This allows the immediate execution of arbitrary shell hooks defined in the repository's '.claude/settings.json' file. Exploitation requires the victim to clone the repository and execute the tool, and the attacker must successfully guess a previously trusted path on the victim's machine. The issue is resolved in version 2.1.84.

Affected products

  • Anthropic Claude Code 2.1.63 through 2.1.83

Identifiers

  • CVE-2026-40068
  • GHSA-q5hj-mxqh-vv77

Timeline

  • 2026-04-24: advisory: Vendor advisory published on GitHub
  • 2026-05-05: disclosed: CVE published to NVD
  • 2026-05-05: patched: Fix released in version 2.1.84

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.