Which versions of Claude Code are affected by CVE-2026-55607?

Claude Code CLI for macOS (versions 2.1.38-2.1.162) contains a sandbox escape vulnerability allowing code execution in the user's home directory when users clone malicious repositories.. A patch is available.

How to fix or mitigate CVE-2026-55607?

Within 24 hours: Audit installed Claude Code CLI versions across macOS endpoints to identify users on versions 2.1.38-2.1.162. Within 7 days: Upgrade all affected systems to Claude Code CLI 2.1.163 or later via configuration management. Within 30 days: Review system audit logs and shell configuration files (.zshenv, .bashrc, .profile) on affected user accounts for signs of unauthorized file modifications.

Claude Code CVE-2026-55607

Q: What is the CVSS score of CVE-2026-55607?

CVE-2026-55607 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-40117 HIGH

Path Traversal (CWE-22)

2026-06-29 GitHub_M

GHSA-7835-87q9-rgvv

RCE Path Traversal Red Hat Claude Code Anthropics

7.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Malicious repo is network-delivered (AV:N) but needs symlink/fsmonitor chaining (AC:H) and the victim to clone and run the tool (UI:R); the sandbox escape changes scope (S:C) with full host code execution (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 29, 2026 - 16:01 EUVD

Analysis Generated

Jun 29, 2026 - 15:19 vuln.today

DescriptionCVE.org

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.

AnalysisAI

Sandbox escape and code execution in Anthropic's Claude Code CLI (versions 2.1.38 through 2.1.162) lets a malicious repository break out of the macOS seatbelt sandbox by abusing git worktree handling. By creating a worktree named ".git" and combining symlink manipulation with git fsmonitor execution, an attacker can overwrite files in the user's home directory such as .zshenv to achieve code execution outside the sandbox. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but exploitation is realistic since it only requires a user to clone and open a booby-trapped repo; it is fixed in 2.1.163.

Technical ContextAI

Claude Code is an agentic command-line coding assistant that runs untrusted repository content inside a macOS seatbelt sandbox to contain side effects. The flaw is a CWE-22 path traversal / git directory confusion in the tool's git worktree feature: git resolves the special ".git" path to locate repository metadata and hooks, so allowing a worktree named ".git" and permitting navigation to worktrees outside the sandboxed context lets an attacker control which directory git treats as the repo. The exploit weaponizes git's fsmonitor mechanism (a configurable program git runs automatically during worktree operations) together with symlinks, so file writes intended for the worktree are redirected into the user's home directory. Shells source startup files such as .zshenv on launch, turning an arbitrary file overwrite into host code execution outside the seatbelt confinement. Per the supplied CPE (cpe:2.3:a:anthropics:claude-code), the affected component is the Claude Code application itself rather than git.

RemediationAI

Vendor-released patch: 2.1.163 - upgrade Claude Code to 2.1.163 or later, which fixes the worktree handling, per advisory GHSA-7835-87q9-rgvv (https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv). Until patched, the most effective compensating control is to avoid cloning or running Claude Code against untrusted or unfamiliar repositories, since exploitation requires opening a malicious repo; treat third-party repos as hostile and inspect them (especially for unusual worktrees, symlinks, and git core.fsmonitor configuration or hooks) before pointing the tool at them. Where feasible, run Claude Code on disposable or strongly isolated machines or containers so a sandbox escape does not reach a trusted home directory, accepting the trade-off of reduced convenience and added setup overhead. Do not rely on the seatbelt sandbox alone as a trust boundary for untrusted code on vulnerable versions.