GHSA-q5hj-mxqh-vv77: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

Summary

Claude Code used the git worktree `commondir` file to determine folder trust without validating its contents. A crafted repository whose `commondir` points to a path the victim had already trusted could bypass the trust dialog and run malicious hooks defined in `.claude/settings.json`. Exploitation required the victim to clone the malicious repository, run Claude Code inside it, and the attacker to know or guess a previously trusted path.

Mitigation

Users on standard Claude Code auto-update have already received the fix. Users performing manual updates are advised to update to the latest version.

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database