RCE in Anthropic Claude Code
CVE-2026-40068
In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (23.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Anthropic Claude_code
- Anthropics Claude-code — versions >= 2.1.63, < 2.1.84
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40068?
- CVE-2026-40068 is a high-severity vulnerability in Anthropic Claude Code, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2026-05-05.
- How severe is CVE-2026-40068?
- High severity. CVSS v3 base score is 8.8 out of 10.