CVE-2026-55607

CVE Enrichment

CVSS: 7.7 HIGH
EPSS: 0.69%
EPSS Percentile: 52.13%
CISA KEV: Not listed

Description

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 29-Jun-2026 22:16
Last Modified: 30-Jun-2026 23:17
EPSS Date: 2026-10-22
CWE: CWE-22, CWE-59, CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

anthropic / claude_code
Version / affected range: * · from (inclusive) 2.1.38 · before (exclusive) 2.1.163
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

References

[email protected]

Last enrichment sync: 23-Oct-2026 03:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Anthropic has previously disclosed pre-trust execution flaws in Claude Code, and its June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations. Malicious Git Configurations Can Trigger Code Execution in AI Coding Agents

CVE (3)

People (1)

MITRE ATT&CK (1)

Vendors (6)

Products (9)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.