CVE-2026-55607Disclosure(anthropic / claude_code)

MEDIUMCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch anthropic claude_code systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

anthropic CVEs Back to dashboard

4.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv

Weakness type (CWE)

CWE-22CWE-59CWE-78

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

claude_code

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 8 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 5 signals
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 11 signals
Disclosure: 6 classified signals
Peaked 7d ago at 2 mentions (2026-06-26); latest day: 1
13 total mentions across 8 days

Affected systems

Vendors

anthropic

Products

claude_code

Deep dive

Activity timeline13 mentions / 8d

Signal classification4 categories

Disclosure

646.2%

PoC

430.8%

Exploit

215.4%

General

17.7%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-26	2	Exploit1PoC1
2026-06-28	1	PoC1
2026-06-29	2	Disclosure1General1
2026-07-08	2	Disclosure1PoC1
2026-07-09	2	Disclosure1PoC1
2026-07-10	2	Disclosure1Exploit1
2026-07-14	1	Disclosure1
2026-09-07	1	Disclosure1

Full discourse13 posts

metnew@v_metnew91d
PoC
Claude Code Full Sandbox Escape (CVE-2026-55607) writeup: https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape#human-written-super-tldr-summary-of-the-bug prompt injection -> code execution on the host. works even in read-only permissions mode + full sandbox (it could be my Pwn2Own bug, but p2o was weird this year lol) https://t.co/UOjXsQ3O5n
Post summary
The tweet references CVE‑2026‑55607, linking to a write‑up that includes a proof of concept for a sandbox escape via prompt injection, but it does not report a public exploit, patch, or active exploitation.
26196131.1K812101.5K
3.9K followersView on X
N45HT@N45HTOfficial78d
PoC
$3,700 Anthropic Bug Bounty 🤑 [CVE-2026-55607] Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion by Metnew 🤯🔥 👨‍💻 Metnew (x/v_metnew) 🔗 https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-55607 🔗 https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv https://t.co/aaQqXSGcy0
Post summary
A write‑up for CVE‑2026‑55607 outlines unsandboxed code execution via .git worktree confusion, includes a PoC and vendor advisory, and is supported by a $3,700 Anthropic bug bounty.
277249432339.6K
676 followersView on X
Md Ismail Šojal 🕷️@0x0SojalSec76d
Exploit
$3,700 Anthropic bounty for breaking Claude Code’s sandbox with one clever .git trick CVE-2026-55607 High (CVSS 7.7) Claude Code allowed creation of worktrees named .git. Combined with: - Symlink following in worktree tools - Git fsmonitor hook execution - zsh sourcing ~/.zshenv before seatbelt sandbox Full unsandboxed RCE via prompt injection. This is next-level: Prompt injection on .git worktree confusion symlink to $HOME to write to ~/.zshenv before sandbox kicks in. If you’re using Claude Code, update to v2.1.163 right now. https://x.com/N45HTOfficial/status/2074874112548507852/video/1
Post summary
CVE‑2026‑55607 enables unsandboxed RCE in Claude Code through .git worktree manipulation; Anthropic offered a $3,700 bounty and recommends patching to v2.1.163.
3180143789.8K
54.4K followersView on X
NullSecurityX@NullSecurityX78d
PoC
Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion by Metnew CVE-2026-55607 https://www.youtube.com/@NullSecurityX Github: https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape https://t.co/JhQq5YlbC5
Post summary
The post announces CVE‑2026‑55607, highlighting unsandboxed code execution via prompt injection and provides a GitHub repository that hosts a PoC exploit.
116089537.1K
12.3K followersView on X
QCXINT@QCXINT_78d
Disclosure
🚨 Claude Code vulnerability earns a $3,700 bug bounty. A new vulnerability (CVE-2026-55607) shows how prompt injection combined with ".git" worktree confusion could lead to unsandboxed code execution. The issue has already been patched by Anthropic. If you're building AI coding agents or autonomous developer tools... this write-up is worth studying to better understand the security risks around agent execution and prompt injection. Research: https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-55607 Anthropic Security Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv
Post summary
A newly disclosed vulnerability (CVE-2026-55607) in Claude Code allows unsandboxed code execution via prompt injection and .git worktree confusion, has a public PoC in a GitHub write‑up, and has already been patched by Anthropic.
060203511.0K
1.8K followersView on X
Md Ismail Šojal 🕷️@0x0SojalSec76d
Disclosure
A High-severity sandbox escape (CVE-2026-55607) - http://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv - http://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape
Post summary
The text announces CVE‑2026‑55607, a high‑severity sandbox escape, and provides links to a GitHub advisory and a write‑up, but offers no exploitation code, patch details, or evidence of active abuse.
00033716
54.4K followersView on X
Aircorridor@_aircorridor73d
Disclosure
Code Execution Vulnerability in Claude Code by Anthropics CVE-2026-55607 | Severity: HIGH https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv
Post summary
The post announces a high‑severity code execution vulnerability (CVE‑2026‑55607) in Claude Code, referencing a GitHub security advisory for further details.
01022421
13.6K followersView on X
Tochukwu Okonkwor@tokonkwor17d
Disclosure
Affected agents named in the disclosure: Claude Code, OpenAI Codex, Cursor, Goose, Nous Hermes Agent, Qwen Code, and xAI Grok Build. CVEs assigned include CVE-2026-71963 and CVE-2026-55607.
Post summary
The text announces two new CVEs, CVE-2026-71963 and CVE-2026-55607, affecting several AI agents in a formal disclosure.
1001083
25 followersView on X
クロニキ｜Claude Code専門家@chroniki_ai78d
Disclosure
今回発見された脆弱性（CVE-2026-55607）は何が問題だったのか。専門用語を噛み砕くとこういう話です： ❌ 問題のある状態 Claude Codeは「.git」という名前のworktree（作業フォルダの分身）を作れてしまった。攻撃者がここに悪意ある指示を仕込む（＝プロンプトインジェクション）と... ⭕ 何が起きるか Claude Codeがサンドボックス（安全な箱）の外でコードを実行してしまう。本来触れてはいけないシステムのファイルにまで手が届く状態に。 → 「Claude Codeが何かしてくれる」を悪用した攻撃です。
Post summary
The post describes the technical details of CVE-2026‑55607, noting that a prompt‑injection in Claude Code can create a malicious .git worktree, leading to sandbox escape and unauthorized system file access.
10000507
936 followersView on X
Prasenjit Sarkar@stretchcloud90d
Exploit
The attack surface for agentic coding tools just got a proper name: CVE-2026-55607. Claude Code's worktree handling let an attacker name a worktree ".git" and navigate it outside the sandbox context. From there: symlink manipulation plus git fsmonitor execution rewrites ~/.zshenv and you have code execution on the host. Works in read-only permissions mode. Works with the full sandbox on. The entry point is a malicious repo with embedded prompt injection. Clone it, point Claude Code at it, and the rest runs itself. This is the third distinct Claude Code sandbox escape class in 2026. The network allowlist bypass (May 2026) let agents exfiltrate data via protocol manipulation. CVE-2026-25725 used settings.json config injection to persist across sessions. Now the worktree path confusion vector that reaches the host even when you thought the sandbox was airtight. The pattern I keep seeing: the attack surface for coding agents is not the model. It's the filesystem and shell integrations that make agents useful in the first place. Read-only mode, sandboxing, allowlists, none of these form a hard boundary when the tooling around code execution is complex enough. Cursor, Windsurf, Cody, Devin, every tool that wraps an LLM with shell access faces the same structural problem. The boundary between "agent reads files" and "agent runs code" is thinner than any of the sandboxes suggest. The current fix: auto-update. Long-term, the missing piece is deterministic file access auditing at the kernel level, not trust in the agent's own sandbox logic. https://x.com/v_metnew/status/2070369295704482296
Post summary
The tweet explains a sandbox escape via worktree path confusion with detailed exploitation steps, notes an auto‑update fix, and highlights that no active attacks are reported.
00001158
2.3K followersView on X
Infoflowcloud@infoflowcloud87d
General
🚨*CVE* CVE-2026-55607 Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktr… https://www.cve.org/CVERecord?id=CVE-2026-55607 ----- Traducción: CVE-2026-55607 Cla… http://infoflow.cloud`
Post summary
The text references CVE-2026-55607, providing limited technical details and a link, but offers no evidence of exploitation, patches, or PoCs.
0000039
89 followersView on X
CVE@CVEnew87d
Disclosure
CVE-2026-55607 Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktr… https://www.cve.org/CVERecord?id=CVE-2026-55607
Post summary
The post discloses a flaw in Claude Code versions 2.1.38–2.1.163 that permits creation of a ".git" worktree and navigation to it, potentially exposing repository data. No PoC, exploit, or patch is referenced.
00000776
57.7K followersView on X
Bryan@so_sthbryan88d
PoC
Claude Code has a full sandbox escape even with read-only permissions. CVE-2026-55607: - Prompt injection to host code execution - Works even with full sandbox and read-only mode - PoC writeup live on GitHub If you run Claude Code with YOLO mode, patch now. https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape
Post summary
The post announces CVE‑2026‑55607, provides a link to a GitHub PoC, includes technical details of the sandbox escape, and urges users to patch to mitigate the risk.
0000094
98 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anthropic	claude_code	-	node.js	-

Explore more

Back to dashboard anthropic CVEs claude_code vulnerabilities

What researchers are saying

CVE-2026-55607

Md Ismail Šojal 🕷️[verified]@0x0SojalSecExploit

CVE‑2026‑55607 enables unsandboxed RCE in Claude Code through .git worktree manipulation; Anthropic offered a $3,700 bounty and recommends patching to v2.1.163.

Md Ismail Šojal 🕷️[verified]@0x0SojalSecDisclosure

The text announces CVE‑2026‑55607, a high‑severity sandbox escape, and provides links to a GitHub advisory and a write‑up, but offers no exploitation code, patch details, or evidence of active abuse.

Tochukwu Okonkwor[verified]@tokonkworDisclosure

The text announces two new CVEs, CVE-2026-71963 and CVE-2026-55607, affecting several AI agents in a formal disclosure.

クロニキ｜Claude Code専門家[verified]@chroniki_aiDisclosure

The post describes the technical details of CVE-2026‑55607, noting that a prompt‑injection in Claude Code can create a malicious .git worktree, leading to sandbox escape and unauthorized system file access.

Prasenjit Sarkar[verified]@stretchcloudExploit

The tweet explains a sandbox escape via worktree path confusion with detailed exploitation steps, notes an auto‑update fix, and highlights that no active attacks are reported.

Bryan[verified]@so_sthbryanPoC

The post announces CVE‑2026‑55607, provides a link to a GitHub PoC, includes technical details of the sandbox escape, and urges users to patch to mitigate the risk.

metnew@v_metnewPoC

The tweet references CVE‑2026‑55607, linking to a write‑up that includes a proof of concept for a sandbox escape via prompt injection, but it does not report a public exploit, patch, or active exploitation.

N45HT@N45HTOfficialPoC

A write‑up for CVE‑2026‑55607 outlines unsandboxed code execution via .git worktree confusion, includes a PoC and vendor advisory, and is supported by a $3,700 Anthropic bug bounty.