Claude Code EUVD-2026-40117

Exploitation requires the victim to clone a malicious repository containing prompt-injection content and then run Claude Code (versions 2.1.38-2.1.162) against it; the repo must carry a git worktree named ".git" and rely on symlink manipulation plus git fsmonitor execution during worktree operations to redirect writes into the home directory (for example overwriting .zshenv). The impact is realized specifically against the macOS seatbelt sandbox model. Limiting factors: the attack is not zero-click - it needs user interaction (cloning and opening the hostile repo, matching CVSS UI:P and the AT:P attack requirement), depends on a non-default malicious repository structure, and depends on shell-startup behavior (a shell that sources the overwritten file) to gain execution; it is unauthenticated (PR:N) from the attacker's side but cannot succeed against trusted or benign repositories.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, base 7.7) signals network delivery with no authentication but with a present attack requirement (AT:P) and passive user interaction, which aligns with the description: the attacker needs no credentials, but the victim must clone a malicious repo and run Claude Code against it, and a prompt-injection/setup condition must hold. No EPSS score, SSVC decision, or KEV listing was provided, and no public proof-of-concept was identified, so there is no evidence of active or automatable exploitation today. Note a tension between the input AC:L and the technical reality: reliable exploitation chains symlink manipulation with fsmonitor timing, which is non-trivial, so practical attack complexity is arguably higher than AC:L suggests - verify against the vendor advisory. Overall this is a credible, high-impact developer-supply-chain risk (full sandbox escape to RCE) gated behind user interaction and a malicious-repo precondition, making it a patch-soon rather than drop-everything emergency in the absence of in-the-wild exploitation data.

An attacker publishes an attractive open-source repository seeded with prompt-injection content and a crafted git worktree named ".git" plus malicious symlinks and fsmonitor configuration. A developer clones it and runs Claude Code against the project; during worktree operations git executes the attacker-controlled fsmonitor program and writes are redirected via symlinks to overwrite ~/.zshenv. The next shell launch sources the poisoned file and runs the attacker's code on the host, outside the seatbelt sandbox. No public PoC was identified at time of analysis.