CVE-2026-55607: 
MinimOS vulnerability analysis and mitigation

CVE-2026-55607 is a sandbox escape vulnerability in Anthropic's Claude Code agentic coding tool, titled "Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution." It affects Claude Code versions 2.1.38 through 2.1.163 (exclusive) distributed as the npm package @anthropic-ai/claude-code. The vulnerability was reported via HackerOne by researcher Metnew, published on June 29, 2026, and fixed in version 2.1.163. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a combination of path traversal (CWE-22), improper symlink resolution (CWE-59), and OS command injection (CWE-78) in Claude Code's git worktree handling logic. Claude Code failed to prevent the creation of worktrees named .git or the navigation to worktrees located outside the seatbelt sandbox boundary, enabling git directory confusion attacks. An attacker crafts a malicious repository containing prompt injection content and embedded symlinks; when Claude Code performs worktree operations on this repository, it follows the symlinks outside the sandbox and triggers git fsmonitor execution, which can be weaponized to overwrite arbitrary files in the user's home directory (e.g., .zshenv). Exploitation requires the victim to clone the malicious repository and run Claude Code against it (GitHub Advisory). A public write-up and proof-of-concept are available at the researcher's GitHub repository (Metnew Write-up).

Successful exploitation allows an attacker to escape Claude Code's seatbelt sandbox and execute arbitrary code in the context of the user's account on the host system, completely bypassing sandbox restrictions. The attacker can overwrite sensitive shell initialization files such as .zshenv, enabling persistent code execution that runs every time the user opens a new shell session. This results in high confidentiality, integrity, and availability impact on the vulnerable system, with potential for credential theft, data exfiltration, and further lateral movement within the user's environment (GitHub Advisory, Red Hat Bugzilla).

As of the time of publication, there is no confirmed evidence of active in-the-wild exploitation, and no exploit kit integration has been reported (GitHub Advisory). However, a public proof-of-concept write-up was published by the reporting researcher (Metnew) on GitHub shortly after disclosure (Metnew Write-up). The EPSS score is approximately 0.71%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Craft a malicious repository: Create a git repository containing prompt injection content designed to manipulate Claude Code's agentic behavior, along with embedded symlinks pointing to locations outside the intended sandbox directory (e.g., targeting the user's home directory).
2. Embed a .git-named worktree configuration: Configure the repository so that Claude Code's worktree handling will attempt to create or navigate to a worktree named .git, triggering git directory confusion.
3. Set up a malicious fsmonitor hook: Place a malicious git fsmonitor hook script within the repository that will execute when git fsmonitor is triggered during worktree operations.
4. Social engineer the victim: Distribute the malicious repository (e.g., via a public hosting platform, phishing, or supply chain attack) and trick the target user into cloning it.
5. Trigger exploitation: The victim runs Claude Code against the cloned repository. Claude Code's worktree handling follows the symlinks outside the sandbox, navigates to the attacker-controlled .git worktree, and triggers git fsmonitor execution.
6. Overwrite shell initialization files: The fsmonitor hook or symlink traversal overwrites a file such as ~/.zshenv with attacker-controlled content.
7. Achieve persistent code execution: The next time the victim opens a shell session, the overwritten .zshenv executes the attacker's payload outside of any seatbelt sandbox restrictions, granting full unsandboxed code execution (GitHub Advisory, Metnew Write-up).

• File System: Unexpected modification timestamps or content changes to shell initialization files such as ~/.zshenv, ~/.zshrc, ~/.bashrc, or ~/.bash_profile in the user's home directory; presence of a .git-named directory in unexpected locations within the Claude Code working directory or sandbox path.
• File System: Unusual symlinks within cloned repository directories pointing to locations outside the repository root, particularly targeting home directory paths.
• Process: Unexpected child processes spawned by git fsmonitor hooks (e.g., sh, bash, curl, python, node) during Claude Code worktree operations.
• Logs: Shell history or audit logs showing execution of unexpected commands immediately after a new shell session is opened, consistent with .zshenv payload execution.
• Network: Outbound connections to unknown external hosts initiated by shell processes shortly after Claude Code is run against a repository, potentially indicating reverse shell or data exfiltration activity (GitHub Advisory).

Anthropic has released a fix in Claude Code version 2.1.163. Users on standard Claude Code auto-update have already received this fix automatically; users performing manual updates should upgrade to version 2.1.163 or later immediately. As a behavioral workaround, users should avoid cloning or running Claude Code against repositories from untrusted or unknown sources until the patch is applied (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported through HackerOne by researcher Metnew, who subsequently published a public write-up and proof-of-concept on GitHub (Metnew Write-up). Red Hat tracked the issue via their security response process and assigned it high severity (Red Hat Bugzilla). Tenable added detection coverage via their plugin pipeline. The Resilient Cyber newsletter included coverage of the vulnerability in their security digest (Resilient Cyber). Community discussion on social media noted the novel attack chain combining prompt injection, symlink manipulation, and git fsmonitor abuse as a particularly creative sandbox escape technique.