CVE-2026-55607

HighCVSS 8.8/10Last modified Jun 30, 2026

Description

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-59 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 29, 2026
Last modified: Jun 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-556085.4n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-te CVE-2026-556097.1sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consc CVE-2026-55616.3A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of th CVE-2026-556108.7InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to CVE-2026-556110.0AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti CVE-2026-556159.2Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated CVE-2026-556176.9Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj CVE-2026-556186.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556195.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-55629.8A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/tes CVE-2026-556207.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556217.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copyin