# CVE-2026-55607: Anthropic Claude Code sandbox escape via git worktree path confusion

Source: https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-55607 · Severity: high · CVSS 4 · Published 2026-06-29

Claude Code, an AI-powered coding assistant, contained a vulnerability that allowed it to bypass its security sandbox. By tricking a user into running the tool against a malicious repository, an attacker could gain the ability to overwrite sensitive files on the user's computer, such as shell configuration files. This could lead to full control over the user's system, bypassing the protections intended to keep the AI's actions isolated.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-55607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55607 being exploited in the wild.

**How severe is CVE-2026-55607?** High severity, with a CVSS score of 4, published 29 June 2026.

**Which products and versions are affected?** Anthropic Claude Code >= 2.1.38, < 2.1.163; @anthropic-ai/claude-code (npm) >= 2.1.38, < 2.1.163, SEMVER:introduced=2.1.38,fixed=2.1.163.

**Is there a fix for CVE-2026-55607?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55607 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55607?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.1.163
  ```


## Technical details

A sandbox escape vulnerability exists in Claude Code due to improper path validation in its Git worktree handling. The tool allowed the creation of worktrees named ".git" and permitted navigation outside the intended sandbox directory. By combining symlink manipulation with the execution of 'git fsmonitor' during worktree operations, an attacker can achieve path traversal to overwrite arbitrary files in the user's home directory (e.g., .zshenv). Exploitation requires a user to clone a malicious repository containing prompt injection content and execute Claude Code within that context. This results in arbitrary code execution outside of the seatbelt sandbox restrictions. The issue is resolved in version 2.1.163.

## Affected products

- Anthropic Claude Code >= 2.1.38, < 2.1.163

## Identifiers

- CVE-2026-55607
- GHSA-7835-87q9-rgvv

## Timeline

- 2026-06-25: disclosed: Advisory published by Anthropic
- 2026-06-29: advisory: CVE-2026-55607 published to NVD
- 2026-07-24: advisory: GitHub Advisory reviewed and updated

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv](https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv)
- [https://github.com/anthropics/claude-code/releases/tag/v2.1.163](https://github.com/anthropics/claude-code/releases/tag/v2.1.163)
- [https://api.github.com/repos/anthropics/claude-code/security-advisories/GHSA-7835-87q9-rgvv](https://api.github.com/repos/anthropics/claude-code/security-advisories/GHSA-7835-87q9-rgvv)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)
- [Anthropic Claude Code data exfiltration via HuggingFace allowlist bypass](https://junglewise.ai/threats/cve-2026-54316-anthropic-claude-code-data-exfiltration-via-huggingface-allowlist)