On 25 June 2026, Anthropic published a GitHub advisory for CVE-2026-55607, a sandbox escape in Claude Code. The bug sits in how the tool handles git worktrees. A user who ran Claude Code against a malicious repository could end up with code running outside the sandbox. NVD listed the CVE on 29 June.
What's affected
The npm package @anthropic-ai/claude-code, versions 2.1.38 up to but not including 2.1.163. The patched version is 2.1.163. The advisory rates it High, CVSS 4.0 score 7.7, and lists CWE-22, CWE-59 and CWE-78.
According to the advisory, Claude Code allowed worktrees named .git and let a session navigate to worktrees outside the sandbox context. By manipulating symlinks and abusing git's fsmonitor execution during worktree operations, an attacker could overwrite a file such as .zshenv in the home directory. That gives code execution outside the seatbelt restrictions the next time a shell starts.
Reliable exploitation needed the victim to clone a malicious repository containing prompt injection content and run Claude Code against it. Anthropic credited a researcher reporting through HackerOne. Users on standard auto-update received the fix automatically.
What to do now
- Run
claude --versionon every machine and upgrade anything below 2.1.163. For a global npm install,npm ls -g @anthropic-ai/claude-codeshows the version too. - Check
~/.zshenv,~/.zprofileand~/.zshrcfor modification times or lines you do not recognize, especially on machines where the tool opened unfamiliar repositories. - Look for directories named
.gitinside worktree locations that do not belong to a real repository. - Open third-party repositories in a disposable container or VM when an agent is attached.
How this could have been avoided
- Reject reserved names for worktrees. A worktree called
.gitshould never be creatable. This is input validation at the point of creation. - Disable fsmonitor execution inside agent sessions. The chain relied on git running a configured helper during worktree operations.
- Make shell startup files unwritable from the sandbox. The payoff was
.zshenv. Denying writes to home-directory dotfiles removes it. - Separate untrusted repositories from your real home directory. A throwaway environment turns an escape into a non-event.
Quick check
Which Claude Code version first contains the fix for CVE-2026-55607?
2.1.163. The affected range starts at 2.1.38.
