What’s Vulnerable › Vulnerabilities
CVE-2026-40068: Claude Code arbitrary code execution via git worktree commondir trust dialog bypass
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-05 · updated 2026-07-24
- Weakness: CWE-20
Description
In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.
Affected products
- anthropics claude-code: from 2.1.63 before 2.1.84 — fixed in 2.1.84
How to fix
Upgrade to a fixed version: anthropics claude-code 2.1.84. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40068 or the next vulnerability affects your stack