A flaw in Claude Code versions 2.1.63 through 2.1.83 allows an attacker to cause the application to execute arbitrary code by manipulating the git worktree commondir file. The vulnerability relies on missing validation of the commondir contents, which permits the attacker to point the file at a directory the victim has previously marked as trusted. When the application launches, it bypasses the security confirmation dialog and runs hooks defined in .claude/settings.json, resulting in remote code execution.

Anthropic’s Claude Code, specifically versions 2.1.63 to 2.1.83, are vulnerable. The flaw affects any users who clone a malicious repository containing a crafted commondir file and subsequently run Claude Code within that repository.

The CVSS score of 7.7 indicates a high severity. Exploitation requires the victim to clone the attacker‑crafted repository and run the application within it, and the attacker must know or guess a previously trusted path. There is no current evidence of public exploitation or inclusion in the CISA KEV catalog, and the EPSS score is unavailable. Nonetheless, the potential for arbitrary code execution warrants immediate attention.