| Package | Affected versions | Patched versions |
|---|---|---|
| claude code | ≥ 2.1.63, < 2.1.84 | 2.1.84 |
| @anthropic-ai/claude-code | ≥ 2.1.63, < 2.1.84 | 2.1.84 |
Claude Code used the git worktree commondir file when determining folder trust but did not validate its contents. By crafting a repository with a commondir file pointing to a path the victim had previously trusted, an attacker could bypass the trust dialog and immediately execute malicious hooks defined in .claude/settings.json. Exploiting this required the victim to clone a malicious repository and run Claude Code within it, and for the attacker to know or guess a path the victim had already trusted.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/masato_anzai for reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free