CVE-2026-40068: 
MinimOS vulnerability analysis and mitigation

CVE-2026-40068 is a trust dialog bypass vulnerability in Anthropic's Claude Code AI coding assistant, enabling arbitrary code execution via git worktree spoofing. It affects Claude Code versions 2.1.63 through 2.1.83 (npm package @anthropic-ai/claude-code) and was disclosed on April 24, 2026, with a fix released in version 2.1.84. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Anthropic Advisory).

The root cause is improper input validation (CWE-20) combined with command injection risk (CWE-77) in Claude Code's folder trust determination logic. Claude Code reads the git worktree commondir file to determine whether a folder should be trusted, but fails to validate the file's contents. An attacker can craft a malicious repository containing a commondir file that points to a path the victim has previously trusted; when the victim clones and opens this repository in Claude Code, the tool incorrectly treats the directory as trusted, bypasses its trust confirmation dialog, and automatically executes hooks defined in .claude/settings.json without user consent. Exploitation requires the attacker to know or guess a previously trusted path on the victim's system, and the victim must actively clone and run Claude Code within the malicious repository (Anthropic Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Claude Code process on the victim's machine, achieving full confidentiality, integrity, and availability impact on the vulnerable system. An attacker can exfiltrate sensitive data, modify files, install persistent malware, or use the compromised developer workstation as a pivot point for lateral movement within a corporate network. Because Claude Code is typically run by developers with broad access to source code, credentials, and internal systems, the blast radius of a successful attack can be significant (Anthropic Advisory, GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.095–0.136%, placing it in the 33rd percentile for exploitation likelihood within 30 days. The vulnerability was reported to Anthropic via HackerOne by researcher masato_anzai (Anthropic Advisory). Exploitation requires social engineering (convincing a victim to clone a malicious repository), which somewhat limits opportunistic exploitation but remains a realistic threat in targeted supply-chain or spear-phishing scenarios.

1. Reconnaissance: Identify a target developer who uses Claude Code versions 2.1.63–2.1.83 and determine or guess a directory path they have previously marked as trusted in Claude Code (e.g., a common project directory such as ~/projects/myapp).
2. Craft malicious repository: Create a git repository and add a .git/worktrees/<name>/commondir file (or equivalent worktree structure) whose contents point to the previously trusted path on the victim's system (e.g., ../../../../home/victim/projects/myapp/.git).
3. Embed malicious hooks: Add a .claude/settings.json file to the repository root containing malicious hook commands (e.g., a reverse shell or data exfiltration script) that Claude Code will execute automatically when trust is granted.
4. Deliver the repository: Host the malicious repository on a public or private platform (e.g., GitHub, GitLab) and socially engineer the victim into cloning it — for example, via a fake open-source project, a phishing email, or a dependency confusion attack.
5. Trigger execution: When the victim runs claude (Claude Code) within the cloned repository directory, the tool reads the spoofed commondir file, incorrectly identifies the folder as trusted, skips the trust confirmation dialog, and immediately executes the malicious hooks defined in .claude/settings.json with the victim's user privileges (Anthropic Advisory, GitHub Advisory).

• File System: Presence of a .git/worktrees/*/commondir file in a cloned repository whose contents reference an external or unexpected path outside the repository root; suspicious or unexpected .claude/settings.json files containing hook definitions with shell commands, network calls, or encoded payloads.
• Process: Unexpected child processes spawned by the Claude Code Node.js process (e.g., bash, sh, curl, wget, python, nc) shortly after claude is invoked in a repository directory.
• Network: Outbound connections to unknown or suspicious IP addresses or domains initiated by the Claude Code process or its child processes; unexpected DNS lookups from developer workstations following claude invocation.
• Logs: Shell history or audit logs showing execution of commands not initiated by the user, particularly following git clone and claude invocations in the same directory; Node.js process audit logs showing hook execution without a preceding trust dialog interaction.

Anthropic has released a fix in Claude Code version 2.1.84, which validates the contents of the git worktree commondir file before using it for trust determination. Users on standard Claude Code auto-update will have received this fix automatically; users performing manual updates should upgrade to version 2.1.84 or later immediately via npm update -g @anthropic-ai/claude-code. As a precautionary measure until patched, users should avoid cloning and running Claude Code within repositories from untrusted or unknown sources, and should manually inspect .claude/settings.json and git worktree files in any cloned repository before invoking Claude Code (Anthropic Advisory, GitHub Advisory).

The vulnerability was published by Anthropic engineer OctavianGuzu via the GitHub Security Advisory on April 24, 2026, crediting HackerOne researcher masato_anzai for responsible disclosure (Anthropic Advisory). The issue received coverage from several vulnerability tracking and security news outlets including Vulners, VulDB, INCIBE-CERT, and ENISA's EUVD shortly after NVD publication in May 2026. Community discussion was noted on Bluesky and other social platforms, though no major security researcher commentary or widespread media coverage has been identified beyond standard vulnerability database entries.