STUPID-2026-0107

Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)

8.0high
June 25, 2026Source checkedRepro reported

Why 8/10

A malicious repo could escape the sandbox and run code on the next shell start (CVSS 7.7). Needs a cloned repo; fixed, no exploitation reported.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
1/2
Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    N/A — this is a flaw in Claude Code's own sandbox and git-worktree handling, not a task a user asked the agent to perform. It triggers simply from cloning a malicious repository and running Claude Code against it.

  2. Expected behavior

    Claude Code's seatbelt sandbox should confine all file writes and command execution triggered by git operations to the project workspace, regardless of what a repository's own worktrees, symlinks, or git configuration attempt to do — so that opening an untrusted repo cannot cause files to be written outside the sandbox.

  3. Actual behavior

    Versions >= 2.1.38 and < 2.1.163 allowed creation of a git worktree literally named ".git", producing git-directory confusion. Combined with symlink manipulation and triggering of git's fsmonitor during worktree operations inside a specially crafted repository containing prompt injection content, an attacker-controlled worktree could be navigated to a location outside the sandbox and used to overwrite a shell initialization file (e.g. ~/.zshenv) in the user's home directory.

  4. Damage

    Overwriting the user's shell init file gave an attacker unsandboxed, arbitrary code execution the next time a shell started, with full confidentiality, integrity, and availability impact (CVSS v4.0 7.7, High: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H). Exploitation required the user to clone a malicious repository and run Claude Code against it. Reported by security researcher metnew via HackerOne; fixed in Claude Code 2.1.163, with users on standard auto-update receiving the fix automatically.

Full write-up

Security researcher metnew (via HackerOne) found that Claude Code's handling of git worktrees could be abused by a malicious repository to escape its own sandbox. The bug chained several small weaknesses: Claude Code allowed a worktree to be created with the name ".git", which confused git about which directory was the real repository metadata; that confusion, combined with symlink manipulation and Claude Code triggering git's fsmonitor during worktree operations, let a specially crafted repository — one that also carried prompt injection content — steer a worktree path outside the sandbox boundary entirely. From there, the attack could overwrite a shell initialization file such as ~/.zshenv in the user's home directory. The next time the victim opened a shell, the attacker's code ran with the user's own privileges, no sandbox in effect. No user action beyond cloning the repository and running Claude Code against it was required. Anthropic assigned CVE-2026-55607, rated the flaw High (CVSS v4.0 7.7), and fixed it in version 2.1.163 by closing off the worktree-naming and path-confusion path; users on Claude Code's standard auto-update received the fix without any action on their part.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Other
Domain
Security
OWASP Agentic Top 10 (our mapping)
ASI05 Unexpected Code Execution (RCE) list
MIT AI Risk Repository (our mapping)
2.2 AI system security vulnerabilities and attacks taxonomy
Source
Security Research

Related incidents

9.0
Cursor's terminal sandbox trusted an agent-set working directory, letting zero-click prompt injection escape it and gain code execution (CVE-2026-50548)
8.0
Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution
8.0
Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)
6.0
Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0107: Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0107/ (accessed 2026-10-29). CC BY 4.0.

← STUPID-2026-0106By IDSTUPID-2026-0108 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.