Claude Code: Unsandboxed Code Execution from Prompt Injection via Git Worktree Path Confusion (CVE-2026-55607)

CVE

CVE-2026-55607

Vendor

Anthropic

Product

Claude Code

Affected versions

< 2.1.163

CVSS

7.7

Published

2026-06-26 04:42

Collected

2026-10-17 01:25

---
id: 9145
title: "Claude Code: Unsandboxed Code Execution from Prompt Injection via Git Worktree Path Confusion (CVE-2026-55607)"
cve: CVE-2026-55607
cvss: 7.7
severity: high
vendor: "Anthropic"
product: "Claude Code"
affected_versions: "< 2.1.163"
source_domain: github.com
source_url: "https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape"
published_at: "2026-06-26T04:42:10Z"
tags: ["ai-security", "bug-bounty", "rce"]
phying_url: "https://phying.com/item/9145"
lang: en
---

# Claude Code: Unsandboxed Code Execution from Prompt Injection via Git Worktree Path Confusion (CVE-2026-55607)

## Summary

Anthropic patched a high-severity sandbox escape vulnerability (CVE-2026-55607, CVSS 7.7) in Claude Code CLI prior to version 2.1.163. Security researcher Metnew demonstrated how prompt injection via CLAUDE.md can manipulate Claude Code's git worktree tools to induce gitdir confusion. By leveraging Git's core.fsmonitor hook and directory symlinks to $HOME, the exploit overwrites ~/.zshenv, achieving unsandboxed code execution outside macOS seatbelt restrictions.

## Why it matters

This research highlights how AI coding agent tools expand the attack surface, demonstrating that prompt injection chained with git filesystem primitives can compromise host environments before process sandbox boundaries initialize.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-55607
- **CVSS:** 7.7
- **Vendor:** Anthropic
- **Product:** Claude Code
- **Affected versions:** < 2.1.163
- **Published:** 2026-06-26T04:42:10Z
- **Original:** https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape
- **Phying News:** https://phying.com/item/9145