Disclosed weakness · no CVE recorded

Creating a worktree could cross Claude Code’s sandbox boundary

Anthropic · Claude Code

First documented disclosure · Review checkpoint

Summary

Anthropic says Claude Code 2.1.319 fixes a sandbox escape during worktree creation.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Vendor-reported fix; no observed malicious exploitation or victim outcome established.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The affected boundary was worktree creation in a sandboxed session. The vendor did not publish the internal cause.

Conditions required

A session using the affected worktree-creation operation. Additional permissions and platform requirements were not specified.

Potential impact

An operation could exceed the sandbox restrictions. The release does not identify what files or services could be reached.

Affected versions and configurations

Earlier affected versions were not enumerated.

Fix and mitigation status

Anthropic lists the fix in Claude Code 2.1.319.

Practical next steps

Update to a maintained version containing the fix and verify the installed version on machines and runners that create worktrees.

Operating lesson

Include repository setup operations when testing an agent’s sandbox, not just commands typed after setup.

Evidence and limits

The author identifies this separately from a Bash approval fix in the same release. No affected starting version, severity score, CVE mapping or platform-specific scope was verified.

Sources