Claude Code git-worktree path confusion let a malicious repo escape the seatbelt sandbox
Anthropic·Claude Code (npm package @anthropic-ai/claude-code, versions 2.1.38–2.1.162)Fixed
Claude Code's worktree handling let a worktree be named ".git" and let navigation reach worktrees outside the sandboxed root; chained with symlink manipulation and execution of git's fsmonitor hook during worktree operations, this let an attacker overwrite files in the user's home directory (e.g. .zshenv) and run code outside the seatbelt sandbox. Reliable exploitation required the user to clone a malicious repository containing prompt-injection content and run Claude Code against it.
- Blast radius
- CISA-ADP's SSVC assessment recorded 'exploitation: none' at disclosure, so no confirmed in-the-wild compromise was reported; the flaw affected all users running the vulnerable npm versions who pointed Claude Code at an untrusted repo, with the demonstrated end state being arbitrary code execution outside the tool's sandbox on the user's machine. Number of affected installs or incidents is not disclosed.
- Root cause
- The sandbox assumed all worktree paths stayed under a trusted root, but Claude Code didn't validate that a worktree name/path (e.g. one literally named ".git" or reached via a symlink) couldn't resolve outside that root, so git's own directory-confusion behavior and fsmonitor hook execution could be chained to break out of the seatbelt restriction.
- How it was caught
- Found and reported externally through HackerOne (researcher 'metnew'), not caught by internal testing; disclosed via GitHub Security Advisory GHSA-7835-87q9-rgvv and assigned CVE-2026-55607.
- What changed
- Patched in Claude Code 2.1.163; users on auto-update received the fix automatically, and manual-update users were advised to upgrade.
Take-awayWhen an agent is allowed to manipulate git worktrees inside a sandbox, independently validate worktree names and resolved paths against traversal and symlink escapes rather than trusting git's own path handling to enforce the sandbox boundary.