CVE-2026-55607— Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| anthropics | claude-code | >= 2.1.38, < 2.1.163 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55607
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Source: NVD (National Vulnerability Database)
Vulnerability Description
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Anthropic Claude Code 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anthropics claude-code是anthropics的AI辅助编程工具。 Anthropic Claude Code 2.1.38版本至2.1.163之前版本存在安全漏洞，该漏洞源于工作树处理允许创建名为“.git”的工作树并导航到沙箱环境之外的工作树，导致git目录混淆攻击，通过利用符号链接操作和git fsmonitor执行，攻击者可以覆盖用户主目录中的文件，导致在seatbelt沙箱限制之外执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| anthropics | claude-code | >= 2.1.38, < 2.1.163 | - |
II. Public POCs for CVE-2026-55607
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55607
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55607 (1)
IV. Related Vulnerabilities
Same product: claude-code
- CVE-2026-46406
Claude Code: Insecure Temporary File in /copy Command Enable - CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved - CVE-2026-44470
Claude Desktop: Local Privilege Escalation via Directory Jun - CVE-2026-44467
Claude Desktop: SSH Host Key Verification Bypass Allows Man- - CVE-2026-40068
Claude Code arbitrary code execution via git worktree common
Same vendor: anthropics
- CVE-2026-46406
Claude Code: Insecure Temporary File in /copy Command Enable - CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved - CVE-2026-44470
Claude Desktop: Local Privilege Escalation via Directory Jun - CVE-2026-44467
Claude Desktop: SSH Host Key Verification Bypass Allows Man- - CVE-2026-40068
Claude Code arbitrary code execution via git worktree common
Same weakness: CWE-22
- CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path trav - CVE-2026-53951
Copier: trust-prefix bypass via path traversal runs tasks un - CVE-2026-14967
Path traversal in github_workflows allows writing artifacts - CVE-2026-55668
File Browser: ScopedFs follows a dangling symlink on write, - CVE-2026-55874
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Sourc
V. Comments for CVE-2026-55607
No comments yet