CVE-2026-55607: @anthropic-ai/claude-code Sandbox Escape via Git Worktree Path Confusion
Summary
CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution. Affects @anthropic-ai/claude-code versions >= 2.1.38, < 2.1.163. Fixed in 2.1.163. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Claude Code is a tool developed by Anthropic AI that leverages Git for version control and collaborative coding. It allows users to manage code efficiently, but its handling of worktrees has introduced a significant vulnerability. This vulnerability arises from the ability to create worktrees named '.git' and navigate outside the intended sandbox context, leading to potential security risks.
Vulnerability Detail
The vulnerability in Claude Code stems from improper handling of Git worktrees, which allows an attacker to create worktrees with misleading names and navigate outside the sandbox. This can lead to git directory confusion attacks, where an attacker manipulates symlinks and exploits git fsmonitor during worktree operations. As a result, they can overwrite critical files in the user's home directory, such as .zshenv, enabling code execution that bypasses seatbelt sandbox restrictions. Exploiting this vulnerability requires the user to clone a malicious repository and run Claude Code against it, posing a significant risk to user security.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.163
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.1.163Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users should avoid cloning untrusted repositories and running Claude Code against them until they can update to the patched version. Additionally, users can manually check their worktree configurations to ensure no malicious entries exist.
Conclusion
The vulnerability identified as CVE-2026-55607 in the @anthropic-ai/claude-code package poses a significant risk due to improper handling of Git worktrees. Users are strongly advised to update to the patched version to mitigate potential security threats.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2026-55607 is a vulnerability in the @anthropic-ai/claude-code package that allows sandbox escape through Git worktree path confusion.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities using package-lock.json.
Exploitation of this vulnerability can lead to unauthorized code execution outside the sandbox, potentially compromising user data and system integrity.
You can update the package by running the command: npm install @anthropic-ai/claude-code@2.1.163 in your terminal.
If you cannot update immediately, avoid running Claude Code with untrusted repositories and check your worktree configurations for any malicious entries.
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
