Is CVE-2026-55607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55607 being exploited in the wild.

How severe is CVE-2026-55607?

High severity, with a CVSS score of 4, published 29 June 2026.

Which products and versions are affected?

Anthropic Claude Code >= 2.1.38, = 2.1.38, < 2.1.163, SEMVER:introduced=2.1.38,fixed=2.1.163.

Is there a fix for CVE-2026-55607?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55607 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55607?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55607: Anthropic Claude Code sandbox escape via git worktree path confusion

Q: Is there a fix for CVE-2026-55607?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55607 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55607?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55607 · Severity: high · CVSS 4 · Published 2026-06-29

Claude Code, an AI-powered coding assistant, contained a vulnerability that allowed it to bypass its security sandbox. By tricking a user into running the tool against a malicious repository, an attacker could gain the ability to overwrite sensitive files on the user's computer, such as shell configuration files. This could lead to full control over the user's system, bypassing the protections intended to keep the AI's actions isolated.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-55607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55607 being exploited in the wild.
How severe is CVE-2026-55607?: High severity, with a CVSS score of 4, published 29 June 2026.
Which products and versions are affected?: Anthropic Claude Code >= 2.1.38, < 2.1.163; @anthropic-ai/claude-code (npm) >= 2.1.38, < 2.1.163, SEMVER:introduced=2.1.38,fixed=2.1.163.
Is there a fix for CVE-2026-55607?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55607 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55607?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later
```
npm install @anthropic-ai/claude-code@2.1.163
```

Technical details

A sandbox escape vulnerability exists in Claude Code due to improper path validation in its Git worktree handling. The tool allowed the creation of worktrees named ".git" and permitted navigation outside the intended sandbox directory. By combining symlink manipulation with the execution of 'git fsmonitor' during worktree operations, an attacker can achieve path traversal to overwrite arbitrary files in the user's home directory (e.g., .zshenv). Exploitation requires a user to clone a malicious repository containing prompt injection content and execute Claude Code within that context. This results in arbitrary code execution outside of the seatbelt sandbox restrictions. The issue is resolved in version 2.1.163.

Affected products

Anthropic Claude Code >= 2.1.38, < 2.1.163

Identifiers

CVE-2026-55607
GHSA-7835-87q9-rgvv

Timeline

2026-06-25: disclosed: Advisory published by Anthropic
2026-06-29: advisory: CVE-2026-55607 published to NVD
2026-07-24: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.