STUPID-2026-0107

Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)

7.7high
June 25, 2026VerifiedReproducible

  1. Instruction given

    N/A — this is a flaw in Claude Code's own sandbox and git-worktree handling, not a task a user asked the agent to perform. It triggers simply from cloning a malicious repository and running Claude Code against it.

  2. Expected behavior

    Claude Code's seatbelt sandbox should confine all file writes and command execution triggered by git operations to the project workspace, regardless of what a repository's own worktrees, symlinks, or git configuration attempt to do — so that opening an untrusted repo cannot cause files to be written outside the sandbox.

  3. Actual behavior

    Versions >= 2.1.38 and < 2.1.163 allowed creation of a git worktree literally named ".git", producing git-directory confusion. Combined with symlink manipulation and triggering of git's fsmonitor during worktree operations inside a specially crafted repository containing prompt injection content, an attacker-controlled worktree could be navigated to a location outside the sandbox and used to overwrite a shell initialization file (e.g. ~/.zshenv) in the user's home directory.

  4. Damage

    Overwriting the user's shell init file gave an attacker unsandboxed, arbitrary code execution the next time a shell started, with full confidentiality, integrity, and availability impact (CVSS v4.0 7.7, High: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H). Exploitation required the user to clone a malicious repository and run Claude Code against it. Reported by security researcher metnew via HackerOne; fixed in Claude Code 2.1.163, with users on standard auto-update receiving the fix automatically.

Security researcher metnew (via HackerOne) found that Claude Code's handling of git worktrees could be abused by a malicious repository to escape its own sandbox. The bug chained several small weaknesses: Claude Code allowed a worktree to be created with the name ".git", which confused git about which directory was the real repository metadata; that confusion, combined with symlink manipulation and Claude Code triggering git's fsmonitor during worktree operations, let a specially crafted repository — one that also carried prompt injection content — steer a worktree path outside the sandbox boundary entirely. From there, the attack could overwrite a shell initialization file such as `~/.zshenv` in the user's home directory. The next time the victim opened a shell, the attacker's code ran with the user's own privileges, no sandbox in effect. No user action beyond cloning the repository and running Claude Code against it was required. Anthropic assigned CVE-2026-55607, rated the flaw High (CVSS v4.0 7.7), and fixed it in version 2.1.163 by closing off the worktree-naming and path-confusion path; users on Claude Code's standard auto-update received the fix without any action on their part.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Other
Domain
Security
Source
Security Research

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.