Product
A high-severity sandbox escape vulnerability, CVE-2026-55607, exists in Claude Code's worktree handling, allowing attackers to achieve unsandboxed code execution by manipulating symlinks and exploiting Git fsmonitor during worktree operations to overwrite user home directory files like .zshenv, requiring a user to clone a malicious repository and run Claude Code against it.