A sandbox escape doesn't need a fancy zero-day. Sometimes it just needs a folder named .git.
That's the crux of CVE-2026-55607, a high-severity vulnerability disclosed on July 24, 2026, affecting Claude Code's git worktree handling — and it lands squarely on servers that lean on Claude Code's sandboxing to run untrusted repos. One flagged server in MCPpedia's index: Pymol Claude MCP.
Severity: High. This is a sandbox escape, not a crash or a data leak. The end state is unsandboxed code execution on the host.
What's actually broken
Claude Code let users create worktrees literally named .git, and allowed navigation into worktrees outside the sandbox's intended context. That's a classic git-directory confusion setup.
Chain that with symlink manipulation and git's fsmonitor hook firing during worktree operations, and an attacker gets a path to overwrite files in the user's home directory — the advisory specifically calls out .zshenv. Overwrite a shell startup file, and the next terminal session runs attacker code outside the seatbelt sandbox that was supposed to contain it.
The sandbox worked exactly as designed — the attacker just walked around it through a symlink and a shell rc file.
Who's exposed
The exploit isn't remote-triggered. It requires the victim to clone a malicious repository — one crafted with the right worktree names and symlinks to trigger the chain during normal git/Claude Code operations. That's a real bar, but not a high one: cloning unfamiliar repos to poke at with an AI coding assistant is exactly the workflow Claude Code is built for.
Pymol Claude MCP is the server tracked against this advisory in MCPpedia's registry. If you're running it — or any MCP server workflow that involves Claude Code cloning and operating on external repositories — you're in the blast radius.
What to do
MCPpedia Scoring System
Total: 100 ptsIf you maintain or depend on Pymol Claude MCP, verify which Claude Code version it assumes at runtime and don't treat the sandbox as a hard boundary against a malicious repo until that's confirmed patched.
Sandboxes are supposed to be the boring, trustworthy layer — the thing you don't have to think about while an AI agent runs commands on your behalf. CVE-2026-55607 is a reminder that "boring and trustworthy" still has to be earned file path by file path, symlink by symlink. Patch first, clone second.
MCP Security Weekly
Weekly CVE alerts, new server roundups, and MCP ecosystem insights. Free.
Keep reading
This article was written by AI, powered by Claude and real-time MCPpedia data. All facts and figures are sourced from our database - but AI can make mistakes. If something looks off, let us know.