CVE-2026-40068 in claude-code
Summary
by MITRE • 05/06/2026
In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
This vulnerability represents a sophisticated path traversal and privilege escalation flaw affecting Claude Code versions 2.1.63 through 2.1.83. The core issue stems from inadequate validation of git worktree commondir file contents during folder trust determination processes. The vulnerability aligns with CWE-22 Path Traversal and CWE-787 Out-of-bounds Write patterns, demonstrating how seemingly innocuous file parsing can create critical security weaknesses. When Claude Code encounters a repository with a crafted commondir file, it fails to properly validate the referenced path before proceeding with trust decisions.
The technical exploitation mechanism relies on an attacker crafting a malicious repository structure where the commondir file contains a path pointing to a location that the victim had previously explicitly trusted. This creates a trust chain that bypasses the normal user confirmation dialogs that would normally prevent execution of potentially harmful hooks. The vulnerability specifically targets the trust determination logic that should act as a security barrier between untrusted repositories and system execution. The attacker's ability to craft this malicious repository requires knowledge or guessing of a path that the victim had already trusted, making this attack vector both targeted and somewhat probabilistic in nature.
The operational impact of this vulnerability is significant as it allows for automated execution of malicious hooks defined in the `.claude/settings.json` file without user consent. This represents a direct violation of the principle of least privilege and could enable attackers to execute arbitrary code on victim systems. The attack requires the victim to perform the specific action of cloning the malicious repository and running Claude Code within that context, but once executed, the malicious hooks can operate with the privileges of the user running Claude Code. This vulnerability demonstrates how trust relationships can be manipulated to create unauthorized code execution paths.
The fix implemented in version 2.1.84 addresses this issue through enhanced validation of commondir file contents before trust decisions are made. This remediation aligns with ATT&CK technique T1059 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation, as it prevents unauthorized execution of system commands through crafted repository structures. The solution likely involves implementing proper path validation, canonicalization checks, and ensuring that trust decisions are not influenced by potentially malicious path references in git worktree files. Organizations should immediately upgrade to version 2.1.84 or later to mitigate this risk, while also implementing monitoring for unusual cloning activities or repository structures that might indicate exploitation attempts. The vulnerability serves as a reminder of the critical importance of validating all external inputs, particularly those that influence trust relationships and security decisions within development environments.