Claude Code Unsandboxed Code Execution from Prompt Injection...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape
• Blog Title: Claude Code: Unsandboxed Code Execution from Prompt Injection via .git Worktree Confusion
• Suggested Section: AI Security / AI Agent Abuse Local AI CLI Tools And MCP; optionally cross-reference macOS Sandbox Debug & Bypass and Git abuse techniques

🎯 Content Summary

Overview

The post analyzes CVE-2026-55607 / GHSA-7835-87q9-rgvv, titled “Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution”, affecting Anthropic Claude Code CLI v2.1.139 on macOS Tahoe. The issue was fixed in Claude Code 2.1.163, deployed on June 4, 2026, and published on June 25, 2026. Severity is High, 🔧 Technical Details

Prompt injection driving trusted AI-agent tools: If an AI coding agent loads repository-local instructions such as CLAUDE.md, a malicious repository can use prompt injection to make the agent invoke built-in tools that the user would not normally consider dangerous. In this case, direct Bash execution was restricted, but the attacker used Claude Code’s trusted CreateWorktree, EnterWorktree, and ExitWorktree tools because those tools internally run Git commands and change filesystem state.

Git worktree name collision with .git: Applications that wrap Git worktrees must reject names that collide with Git metadata paths. Allowing a worktree named .git can cause Git to interpret the worktree path as a Git metadata directory. If the attacker can make that directory contain valid Git metadata, commands like git status may load attacker-controlled repository co...

🤖 Agent Actions

Non-final progress update:

• Re-initialized the task plan
• Current modified file is still only:
  • src/AI/AI-Prompts.md
• The Claude Code section remains in place under the AI section
• Single-file rule is still preserved
• I am keeping the run open and not giving the final wrap-up yet

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 981
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/Metnew/write-ups/tree/main/claude-code-worktree-sandbox-escape

Content Categories: Based on the analysis, this content was categorized under "AI Security / AI Agent Abuse Local AI CLI Tools And MCP; optionally cross-reference macOS Sandbox Debug & Bypass and Git abuse techniques".

Repository Maintenance:

• MD Files Formatting: 981 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0