AI Security Briefing

What it is

GitHub Security Advisory GHSA-7835-87q9-rgvv, a High severity (CVSS v4 base 7.7) vulnerability in Anthropic's claude-code. Claude Code's git worktree handling allowed creation of worktrees named .git and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks that could lead to code execution outside the seatbelt sandbox. Reported by hackerone.com/metnew.

How it works

By exploiting symlink manipulation combined with git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory — the advisory names .zshenv as an example. Because .zshenv is sourced by the shell, overwriting it yields code execution that runs outside the seatbelt sandbox restrictions Claude Code normally enforces.

flowchart TD
    A[User clones malicious repo] --> B[Runs Claude Code against it]
    B --> C[Prompt injection triggers worktree op]
    C --> D[Worktree named .git + symlink manipulation]
    D --> E[git fsmonitor executes]
    E --> F[Overwrite ~/.zshenv]
    F --> G[Code execution OUTSIDE seatbelt sandbox]

Preconditions / Affected

Reliable exploitation required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. The CVSS vector lists User Interaction as "Passive" and Privileges Required as "None" — the malicious action is carried out via the injected content once the user runs the tool against the hostile repo. The advisory does not state specific affected version numbers; it only distinguishes auto-update from manual-update users (see below).

What to do

• Auto-update users: no action needed — the fix has already been received automatically.
• Manual-update users: update to the latest version of Claude Code.

The advisory gives no patch commands or fixed version string beyond this instruction.

Caveats

• The page provides no explicit fixed version number or affected version range, so manual updaters cannot confirm from this advisory alone which build contains the fix — verify you are on the current release.
• Exploitation depends on the user actively cloning and running Claude Code against attacker-controlled content; it is not a remote, unauthenticated drive-by despite the "Network" attack vector rating.