Claude Code is an agentic coding tool

CVE-2026-55607 lives in how @anthropic-ai/claude-code versions >= 2.1.38, < 2.1.163 handled git worktrees. A repo can ship a worktree literally named .git, plus symlinks and a poisoned fsmonitor config. When a developer points Claude Code at the repo and the agent (under prompt injection from README/issue content) performs worktree operations, path confusion + symlink resolution lets git execute core.fsmonitor *outside* the macOS sandbox-exec (seatbelt) profile. The documented payload overwrites ~/.zshenv, so the next shell the user opens runs attacker code as the user. Chained CWEs: CWE-22 (path traversal), CWE-59 (link following), CWE-78 (command injection via git config).

Anthropic rated this High (CVSS 4.0 7.7) and the rating is roughly fair. The novel-CVSS-4.0 vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H properly captures that exploitation needs a user to *passively* run Claude Code against attacker-controlled content (User Interaction: Passive, Attack Requirements: Present). It does not need credentials, doesn't need network position beyond a public repo URL, and the chain ends in code execution as the developer — which on a dev workstation typically means SSH keys, npm/PyPI tokens, AWS creds, and active git push rights to internal repos. We hold the verdict at HIGH rather than CRITICAL because (a) it does not reach hypervisor/IdP/DC blast radius directly and (b) auto-update has already shipped 2.1.163 to the bulk of the installed base.

Why this verdict

• User-interaction gated, but the gate is low: CVSS 4.0 marks UI as *Passive*. A developer only has to run claude against a repo they cloned — they do not have to approve a permission dialog. The friction is a single social-engineering hop (a 'try this cool MCP server' link in Slack), not a multi-stage compromise.
• Endpoint blast radius is high: Code execution as the developer UID on an engineering workstation routinely yields ~/.ssh/, ~/.aws/credentials, ~/.npmrc auth tokens, git push credentials, and Keychain-mediated browser cookies. That is the same footprint that drove the SolarWinds and CircleCI dev-endpoint attack classes.
• Role multiplier: On a standard developer workstation the chain ends in workstation compromise + credential theft — HIGH. On a developer who also holds prod-deploy keys, code-signing keys, or admin rights to internal package registries the chain ends in *supply-chain pivot* — CRITICAL outcome for that role. Because Claude Code's installed base is by definition developers (not random office staff), the supply-chain-adjacent role share is non-trivial; we anchor the floor at HIGH rather than letting friction drag it to MEDIUM.
• Friction adjustments downward: macOS-only confirmed scope (Linux/WSL not enumerated in advisory) narrows reachable population. Default auto-update on npm has likely already retired most vulnerable installs. No KEV listing, no public PoC yet, no observed campaigns.
• Floor check: Verdict floor under the noisgate role-multiplier rule is HIGH (developer-workstation → credential theft / source-tree compromise). Friction is not strong enough to break the floor; we sit *at* HIGH rather than above it because the chain stops at one user and does not auto-propagate.

Why not higher?

Not CRITICAL because exploitation requires user-initiated invocation of Claude Code against attacker-controlled content; it is not wormable, not zero-click, and does not directly compromise identity providers, hypervisors, or CI control planes. SC/SI/SA are :N in the CVSS 4.0 vector — no documented subsequent-system impact in the base chain.

Why not lower?

Not MEDIUM because the affected component runs as the developer on engineering workstations holding production credentials, source code, and push rights. A single successful compromise gives an attacker the same standing as an insider engineer — a category we never park in MEDIUM.

1. Force-upgrade @anthropic-ai/claude-code fleet-wide to ≥ 2.1.163 — Auto-update covers most users but lab/CI/air-gapped installs lag. Push via Jamf/Intune/MDM software policy and verify with claude --version. Per noisgate HIGH SLA, mitigation deployed within 30 days, vendor patch (the same upgrade) within 180 days — for this CVE the mitigation and remediation collapse into the same action.
2. Disable git fsmonitor globally on developer endpoints — Run git config --global core.fsmonitor false and git config --global core.untrackedCache false via configuration management. fsmonitor is the execution primitive used in step 4; killing it neutralizes the chain even on unpatched Claude Code. Deploy within 30 days as a defense-in-depth measure even after patching.
3. Add EDR rule: dotfile writes by git child processes — Alert on writes to ~/.zshenv, ~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.config/fish/conf.d/*, ~/.profile where the parent chain includes git or claude. CrowdStrike CQL, Jamf Protect, SentinelOne STAR rules all support this. High signal, low noise on dev fleets.
4. Restrict Claude Code to vetted directories via MDM — Use macOS configuration profiles to apply a project-allowlist (work repos only) and block invocation from ~/Downloads, /tmp, and ad-hoc clones. Reduces the social-engineering surface for the 'try this repo' attack.
5. Audit and rotate developer-held long-lived credentials — Assume any developer who ran Claude Code on a sketchy repo between 2026-05 and 2026-06-25 is potentially affected. Rotate SSH keys, npm tokens, classic-PAT GitHub tokens, and long-lived AWS keys for high-privilege devs as a precaution; for the rest, prioritize moving to short-lived OIDC/STS issuance.

Run on each developer macOS/Linux workstation. Invoke as the target user (no sudo needed) — e.g. bash check-cve-2026-55607.sh. Exits 0 if patched, 1 if vulnerable, 2 if Claude Code is not installed (UNKNOWN).

#!/usr/bin/env bash
# check-cve-2026-55607.sh — detect vulnerable @anthropic-ai/claude-code
# Vulnerable range: >= 2.1.38, < 2.1.163. Fixed: 2.1.163.
set -u

MIN_FIXED="2.1.163"
MIN_VULN="2.1.38"

version_ge() {
  # returns 0 if $1 >= $2 in dotted-semver
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

find_claude_version() {
  if command -v claude >/dev/null 2>&1; then
    claude --version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
    return
  fi
  # npm global fallback
  if command -v npm >/dev/null 2>&1; then
    npm ls -g --depth=0 --json 2>/dev/null \
      | grep -A1 '"@anthropic-ai/claude-code"' \
      | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
  fi
}

VER="$(find_claude_version)"

if [ -z "${VER:-}" ]; then
  echo "UNKNOWN: claude-code not detected on PATH or via npm -g"
  exit 2
fi

if version_ge "$VER" "$MIN_FIXED"; then
  echo "PATCHED: claude-code $VER (>= $MIN_FIXED)"
  exit 0
fi

if version_ge "$VER" "$MIN_VULN"; then
  echo "VULNERABLE: claude-code $VER is in range [$MIN_VULN, $MIN_FIXED) — upgrade to $MIN_FIXED+"
  exit 1
fi

echo "PATCHED: claude-code $VER (pre-affected range)"
exit 0

Sources

1. Anthropic GHSA-7835-87q9-rgvv advisory
2. CWE-22: Path Traversal
3. CWE-59: Link Following
4. CWE-78: OS Command Injection
5. Check Point research on Claude Code flaws
6. Phoenix Security: Claude Code CVE chain analysis
7. Git fsmonitor documentation (core.fsmonitor)
8. npm @anthropic-ai/claude-code