Claude Code versions 2.1.38 through 2.1.163 allowed a worktree named ".git" to be created and navigated to outside the intended sandbox. An attacker could use symlink manipulation paired with git’s fsmonitor task to overwrite files in the user’s home directory, such as ".zshenv", and trigger execution of code with the user’s privileges. The flaw is a classic directory traversal and path confusion vulnerability (CWE‑22, CWE‑59, CWE‑78) that can compromise confidentiality, integrity, and availability.

The affected vendor is Anthropic, product Claude Code. All releases from 2.1.38 up to but not including 2.1.163 are vulnerable. Version 2.1.163 contains the fix.

The CVSS score of 7.7 indicates a high severity risk; EPSS data is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires the victim to clone a malicious repository containing prompt‑injection content and then invoke Claude Code on that repository. Because the attack is user‑dependent and requires interaction with a malicious repo, the practical exploitability is moderate, but the potential impact remains significant.