Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

High7.7CVE-2026-40068 · Published Apr 24, 2026

Claude Code used the git worktree `commondir` file when determining folder trust but did not validate its contents. By crafting a repository with a `commondir` file pointing to a path the victim had previously trusted, an attacker could bypass the trust dialog and immediately execute malicious hooks defined in `.claude/settings.json`. Exploiting this required the victim to clone a malicious repository and run Claude Code within it, and for the attacker to know or guess a path the victim had already trusted. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to [hackerone.com/masato_anzai](https://hackerone.com/masato_anzai) for reporting this issue.