Iniciar sesión
Deutsch English Español Polski
Alta

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

  • Publicada: 24.04.2026
  • Actualizado: 11.10.2026 10:22

Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents. By crafting a repository with a commondir file pointing to a path the victim had previously trusted, an attacker could bypass the trust dialog and immediately execute malicious hooks defined in .claude/settings.json. Exploiting this required the victim to clone a malicious repository and run Claude Code within it, and for the attacker to know or guess a path the victim had already trusted.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Claude Code thanks hackerone.com/masato_anzai for reporting this issue.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm @anthropic-ai/claude-code >= 2.1.63, < 2.1.84 2.1.84

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Debilidad (CWE)
CWE-20, CWE-77
Plataforma
npm
Paquete
@anthropic-ai/claude-code
Publicada
24.04.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-q5hj-mxqh-vv77 - CC BY 4.0

Historial de vulnerabilidades: @anthropic-ai/claude-code

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (29) en el archivo
Entradas en total
29
Primera → última
06.2025 10.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Alta 23
  • Media 4
  • Baja 2

Divulgaciones por año

Gravedad:
  1. Claude Code: La omisión del anclaje de hash del complemento permite eludir el hash pinning
    Alta CVE-2026-86063 < 2.1.179 2.1.179
  2. Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
    Alta CVE-2026-55607 >= 2.1.38, < 2.1.163 2.1.163
  3. Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution esta entrada
    Alta CVE-2026-40068 >= 2.1.63, < 2.1.84 2.1.84
  4. Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
    Alta · 10.0 CVE-2026-39861 < 2.1.64 2.1.64
  5. Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
    Alta CVE-2026-33068 < 2.1.53 2.1.53
  6. Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json
    Alta CVE-2026-25725 < 2.1.2 2.1.2
  7. Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
    Alta CVE-2026-25723 < 2.0.55 2.0.55
  8. Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection
    Alta CVE-2026-25722 < 2.0.57 2.0.57
  9. Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
    Alta CVE-2026-24887 < 2.0.72 2.0.72
  10. Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
    Alta CVE-2026-24053 < 2.0.74 2.0.74
  11. Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
    Alta CVE-2026-24052 < 1.0.111 1.0.111
  12. Claude Code Command Validation Bypass Allows Arbitrary Code Execution
    Alta CVE-2025-66032 < 1.0.93 1.0.93
  13. @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
    Alta CVE-2025-64755 < 2.0.31 2.0.31
  14. Claude Code vulnerable to command execution prior to startup trust dialog
    Alta CVE-2025-65099 < 1.0.39 1.0.39
  15. Claude Code can execute commands prior to the startup trust dialog
    Alta CVE-2025-59536 < 1.0.111 1.0.111
  16. Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions
    Alta CVE-2025-59828 < 1.0.39 1.0.39
  17. Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
    Alta CVE-2025-59041 < 1.0.105 1.0.105
  18. Claude Code rg vulnerability does not protect against approval prompt bypass
    Alta CVE-2025-58764 < 1.0.105 1.0.105
  19. Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning
    Alta ghsa-ph6w-f82w-28w6 < 1.0.87 1.0.87
  20. Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code
    Alta CVE-2025-55284 < 1.0.4 1.0.4
  21. Claude Code echo command allowed bypass of user approval prompt for command execution
    Alta CVE-2025-54795 < 1.0.20 1.0.20
  22. Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
    Alta CVE-2025-54794 < 0.2.111 0.2.111
  23. Claude Code Improper Authorization via websocket connections from arbitrary origins
    Alta CVE-2025-52882 >= 0.2.116, < 1.0.24 1.0.24

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.