Anthropic Claude Code 2.1.38 < 2.1.163 Sandbox Escape (CVE-2026-55607)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324951);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/06");

  script_cve_id("CVE-2026-55607");

  script_name(english:"Anthropic Claude Code 2.1.38 < 2.1.163 Sandbox Escape (CVE-2026-55607)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by a sandbox
escape vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Anthropic Claude Code installed on the remote host is
2.1.38 prior to 2.1.163. It is, therefore, affected by a sandbox
escape vulnerability:

  - Claude Code's worktree handling allowed creation of worktrees
    named '.git' and navigation to worktrees outside the sandbox
    context, enabling git directory confusion attacks. By exploiting
    symlink manipulation and git fsmonitor execution during worktree
    operations, an attacker could overwrite files in the user's home
    directory (such as .zshenv), leading to code execution outside of
    seatbelt sandbox restrictions. Reliably exploiting this required
    the user to clone a malicious repository containing prompt
    injection content and run Claude Code against it.
    (CVE-2026-55607)

Note that Nessus has not tested for this issue but has instead relied
only on the application's self-reported version number.");
  # https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f335f8e3");
  script_set_attribute(attribute:"solution", value:
"Upgrade Anthropic Claude Code to version 2.1.163 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55607");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:anthropic:claude_code");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("anthropic_claude_code_win_installed.nbin", "anthropic_claude_code_macos_installed.nbin", "anthropic_claude_code_nix_installed.nbin");
  script_require_keys("installed_sw/Anthropic Claude Code");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Anthropic Claude Code', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'min_version': '2.1.38',
          'fixed_version': '2.1.163'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);