CVE-2026-55607

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55607
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55607.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-55607
Aliases
Downstream
Published
2026-06-29T14:04:00.693Z
Modified
2026-07-11T03:53:19.115651414Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Details

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-59",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55607.json"
}
References

Affected packages

Git / github.com/anthropics/claude-code

Affected ranges

Type
GIT
Repo
https://github.com/anthropics/claude-code
Events
Introduced
19bb071fe024c1398d3f0a4b3ada25007cf5182c
Fixed
d1e174252d0af47174bd9fbdec6abb092b49226a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.1.38"
        },
        {
            "fixed": "2.1.163"
        }
    ],
    "cpe": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v2.*
v2.1.100
v2.1.101
v2.1.104
v2.1.105
v2.1.107
v2.1.108
v2.1.109
v2.1.110
v2.1.111
v2.1.112
v2.1.113
v2.1.114
v2.1.116
v2.1.117
v2.1.118
v2.1.119
v2.1.120
v2.1.121
v2.1.122
v2.1.123
v2.1.126
v2.1.128
v2.1.129
v2.1.131
v2.1.132
v2.1.133
v2.1.136
v2.1.137
v2.1.138
v2.1.139
v2.1.140
v2.1.141
v2.1.142
v2.1.143
v2.1.144
v2.1.145
v2.1.146
v2.1.147
v2.1.148
v2.1.149
v2.1.150
v2.1.152
v2.1.153
v2.1.154
v2.1.156
v2.1.157
v2.1.158
v2.1.159
v2.1.160
v2.1.161
v2.1.162
v2.1.38
v2.1.39
v2.1.41
v2.1.42
v2.1.44
v2.1.45
v2.1.47
v2.1.49
v2.1.50
v2.1.51
v2.1.52
v2.1.53
v2.1.55
v2.1.56
v2.1.58
v2.1.59
v2.1.61
v2.1.62
v2.1.63
v2.1.66
v2.1.68
v2.1.69
v2.1.70
v2.1.71
v2.1.72
v2.1.73
v2.1.74
v2.1.75
v2.1.76
v2.1.77
v2.1.78
v2.1.79
v2.1.80
v2.1.81
v2.1.83
v2.1.84
v2.1.85
v2.1.86
v2.1.87
v2.1.88
v2.1.89
v2.1.90
v2.1.91
v2.1.92
v2.1.94
v2.1.96
v2.1.97
v2.1.98

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55607.json"