Security Vulnerability in Claude Code by Anthropics

CVE-2026-40068

What is CVE-2026-40068?

In specific versions of Claude Code, an input validation flaw allows an attacker to exploit the folder trust determination logic. By crafting a malicious repository containing a commondir file that elements the victim previously trusted, the vulnerable system could unwittingly execute potentially harmful scripts defined in the associated configuration file. This exploitation necessitates that the victim clones the crafted repository and runs Claude Code within it. Victims must also have an understanding of which trusted paths to exploit. This significant vulnerability underscores the importance of validating content from external repositories.

References