Attack Chain

1. An attacker crafts a specialized malicious Git repository containing specific worktree configurations and prompt injection content.
2. The malicious repository is designed to exploit the worktree handling vulnerability within Claude Code.
3. A victim is induced, likely through social engineering or other means, to clone this malicious repository onto their system.
4. The victim then runs the vulnerable Claude Code application (version >= 2.1.38, < 2.1.163) against the cloned malicious repository.
5. During Claude Code's internal Git worktree operations, the attacker's crafted repository leverages symlink manipulation and triggers Git's fsmonitor execution feature.
6. This sequence of actions exploits the "Git directory confusion" vulnerability, allowing the creation of a ".git" named worktree outside the application's sandbox.
7. The attacker then overwrites sensitive user configuration files, such as .zshenv or other shell initialization files, located in the victim's home directory.
8. Upon a subsequent login or shell invocation by the victim, the maliciously modified configuration file executes arbitrary code with the user's privileges, effectively achieving unsandboxed code execution.

Impact

Successful exploitation of CVE-2026-55607 leads to a complete sandbox escape, allowing an attacker to execute arbitrary code outside the confines of the Claude Code application's security restrictions. This can result in compromise of the user's system, including data exfiltration, installation of further malware, or disruption of system operations. The vulnerability targets user-specific configuration files in the home directory, meaning an attacker could gain persistent access or elevate privileges within the user's session. While specific victim counts are not provided, any user running affected versions of Claude Code and interacting with a malicious Git repository is at risk.

Recommendation

• Immediately update npm/@anthropic-ai/claude-code to version 2.1.163 or later to patch CVE-2026-55607.
• Educate users about the risks of cloning untrusted Git repositories and running applications like Claude Code against them.
• Monitor file system events for unusual modifications to shell configuration files (e.g., .zshenv, .bashrc, .profile) in user home directories, particularly after Git operations or application launches.