{"action":"Upgrade @anthropic-ai/claude-code to 2.1.84 or later.","affected":[{"fixed":"2.1.84","introduced":"2.1.63"}],"component":"@anthropic-ai/claude-code","cve_ids":["CVE-2026-40068"],"ecosystem":"npm","epss":0.00314,"exploited":false,"fixed_versions":["2.1.84"],"ghsa_id":"GHSA-q5hj-mxqh-vv77","id":"tcs_01M5KG58XJ51F37JRBDHZ7RERC","modified_at":"2026-05-08T15:50:36.976042Z","published_at":"2026-04-24T16:34:03Z","references":["https://osv.dev/vulnerability/GHSA-q5hj-mxqh-vv77","https://github.com/anthropics/claude-code/security/advisories/GHSA-q5hj-mxqh-vv77","https://nvd.nist.gov/vuln/detail/CVE-2026-40068","https://github.com/anthropics/claude-code"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q5hj-mxqh-vv77","url":"https://osv.dev/vulnerability/GHSA-q5hj-mxqh-vv77"},{"source":"nvd","source_id":"CVE-2026-40068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40068"}],"summary":"Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution"}