{"data":{"id":"c8ecc626-723e-4714-8a34-8b9c17576908","title":"CVE-2026-55607: Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of…","summary":"Claude Code versions 2.1.38 through 2.1.163 allowed creation of worktrees named \".git\" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. Through symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files such as .zshenv in the user's home directory, leading to code execution outside seatbelt sandbox restrictions. Reliable exploitation required the user to clone a malicious repository containing prompt injection content and run Claude Code against it.","solution":"Fixed in 2.1.163.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55607","publishedAt":"2026-06-29T15:16:41.597Z","cveId":"CVE-2026-55607","cweIds":["CWE-22","CWE-59","CWE-78"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@>= 2.1.38, < 2.1.163 (fixed: 2.1.163)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":[],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code worktree handling allows sandbox escape via git directory confusion","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00687,"epssCheckedAt":"2026-10-14T18:05:58.202Z","kevDateAdded":null,"advisoryAliases":["GHSA-7835-87q9-rgvv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:19.156Z","patchAvailable":true,"disclosureDate":"2026-06-29T15:16:41.597Z","capecIds":["CAPEC-126","CAPEC-88"],"crossRefCount":1,"attackSophistication":"advanced","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"]}}