Executive brief
Claude Code, an AI-powered coding assistant, contained a vulnerability that allowed it to bypass its security sandbox. By tricking a user into running the tool against a malicious repository, an attacker could gain the ability to overwrite sensitive files on the user's computer, such as shell configuration files. This could lead to full control over the user's system, bypassing the protections intended to keep the AI's actions isolated.
Technical details
A sandbox escape vulnerability exists in Claude Code due to improper path validation in its Git worktree handling. The tool allowed the creation of worktrees named ".git" and permitted navigation outside the intended sandbox directory. By combining symlink manipulation with the execution of 'git fsmonitor' during worktree operations, an attacker can achieve path traversal to overwrite arbitrary files in the user's home directory (e.g., .zshenv). Exploitation requires a user to clone a malicious repository containing prompt injection content and execute Claude Code within that context. This results in arbitrary code execution outside of the seatbelt sandbox restrictions. The issue is resolved in version 2.1.163.
Affected products
- Anthropic Claude Code >= 2.1.38, < 2.1.163
Timeline
- 2026-06-25: disclosed: Advisory published by Anthropic
- 2026-06-29: advisory: CVE-2026-55607 published to NVD
- 2026-07-24: advisory: GitHub Advisory reviewed and updated