CVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents.
What it is
Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents. By crafting a repository with a commondir file pointing to a path the victim had previously trusted, an attacker could bypass the trust dialog and immediately execute malicious hooks defined in .claude/settings.json. Exploiting this required the victim to clone a malicious repository and run Claude Code within it, and for the attacker to know or guess a path the victim had already trusted.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/masato_anzai for reporting this issue.
How to check
- Affected: @anthropic-ai/claude-code (npm) >= 2.1.63, < 2.1.84.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @anthropic-ai/claude-code to 2.1.84 or later.
npm ls @anthropic-ai/claude-code -g # or: claude --versionSources
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
- highCVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
- highCVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File