Directory Traversal in Claude Code

Executive Summary

CVE-2026-55607 is a high-severity vulnerability in Anthropic's Claude Code versions 2.1.38 to 2.1.162. It involves a sandbox escape caused by Git worktree path confusion, where the tool allowed creation of worktrees named ".git" and navigation outside the sandbox context.

Attackers could exploit this by manipulating symbolic links and leveraging Git fsmonitor execution during worktree operations to overwrite files in the user's home directory, such as the .zshenv file. This leads to code execution outside of the seatbelt sandbox restrictions.

To exploit this vulnerability, a user would need to clone a malicious repository containing prompt injection content and run Claude Code against it. The issue has been fixed in version 2.1.163.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if a vulnerable version of Claude Code (versions 2.1.38 to 2.1.162) is installed and if any malicious repositories with crafted worktrees named ".git" or symlink manipulations have been cloned or executed.

You can check the installed version of Claude Code by running a command like:

• npm list @anthropic-ai/claude-code

or if installed globally:

• npm list -g @anthropic-ai/claude-code

To detect suspicious worktrees or symlink manipulations, you can search for unexpected ".git" directories or symlinks outside expected repository locations, for example:

• find /path/to/scan -type d -name ".git"
• find /path/to/scan -type l -ls

Additionally, monitoring for unexpected modifications to files in the user's home directory such as ".zshenv" may indicate exploitation attempts:

• ls -l ~/.zshenv
• stat ~/.zshenv

Since exploitation requires running Claude Code against a malicious repository, reviewing recent repository clones and executions of Claude Code may help identify suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized code execution outside of sandbox restrictions, which compromises the security boundaries intended to protect the system.

An attacker exploiting this could overwrite important files in the user's home directory, potentially leading to persistent compromise, loss of confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Claude Code allows attackers to execute code outside of sandbox restrictions by overwriting files in the user's home directory, which can impact the confidentiality, integrity, and availability of the system.

Such impacts on system security could potentially lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, the provided information does not explicitly mention compliance implications or specific effects on these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update Claude Code to version 2.1.163 or later, as this version contains the fix for the sandbox escape issue.

If you are using auto-updates, ensure they are enabled so that the fix is applied automatically.

For users not using auto-updates, perform a manual update to the patched version to prevent exploitation.

Useful 0 Not Useful 0