CVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Claude Code's worktree handling allowed a worktree named .git and let navigation reach worktrees outside the sandbox context. That confuses which directory git treats as the repository. The advisory says the exploit combined symlink manipulation with git's fsmonitor execution during worktree operations. The result was that files in the user's home directory, such as .zshenv, could be overwritten. Those files run the next time a shell starts, so the code runs outside the seatbelt restrictions.

The attacker does not need access to the machine. They publish or share a repository containing prompt injection text. The victim clones it and runs Claude Code against it, and the model, following the injected instructions, drives the worktree steps. Reliable exploitation required that sequence, which is why the score assumes user interaction.

The outcome is code execution as the user with the sandbox bypassed, so secrets, SSH keys and cloud credentials in the home directory are reachable. The three weakness classes are path traversal, link following and OS command injection.

@anthropic-ai/claude-code from 2.1.38 up to but not including 2.1.163. The advisory describes the sandbox escape for seatbelt, the macOS sandbox. Check your version:

claude --version
npm ls -g @anthropic-ai/claude-code

Installs on standard auto-update have already received the fix.

Upgrade to 2.1.163 or later. Standard auto-update installs it by itself. For manual installs:

npm install -g @anthropic-ai/claude-code@latest

The advisory gives no workaround. The v2.1.163 release notes do not list the worktree change by name, so rely on the advisory for the fixed version. Until you update, avoid running Claude Code against repositories you do not trust.

On a machine that ran an affected version against an untrusted repo, check ~/.zshenv, ~/.zshrc, ~/.bash_profile and other startup files for lines you did not write, and their modification times. Look for a directory or worktree named .git inside a project, unexpected symlinks, and a git config with an fsmonitor setting pointing at a script. Review git worktree list output in the repo. Beam records agent shell commands and file access, and its rules flag risky ones, such as git worktree commands or writes to shell startup files.

Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it.

Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/metnew for reporting this issue.