CVE-2026-55607CWE-22CWE-59CWE-78

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

High · published June 29, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00687 · 52.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-29T14:04Z
EPSS history
Timeline
  • 29 JUN 14:04Z
    Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
    cvelistv5