Claude Code patches a bash permission bypass and a worktree sandbox escape
Version 2.1.319 fixes a crafted environment prefix that could hide part of a bash command from permission checks, and a separate sandbox escape triggered by creating a git worktree.
Claude Code 2.1.319, released on 6 November, the same version that added MCP task backgrounding, quietly fixes two security bugs. The changelog lists them as separate entries: a bash permission bypass where “a crafted environment prefix could hide part of a command from permission checks”, and a sandbox escape “when creating a worktree”.
Neither entry carries a CVE number, a severity rating, or further technical detail in Anthropic’s own notes. Both sit in different versions than an earlier, unrelated worktree sandbox escape Anthropic fixed back in June.
Why it matters: both bugs sit inside the exact mechanisms meant to stop Claude Code running something you didn’t approve, permission checks on bash commands and the sandbox around file and command execution. If you point Claude Code’s bash tool or git worktrees at untrusted repositories or prompts, update to 2.1.319 or later.
The caveat: Anthropic hasn’t published a writeup of either bug beyond the one-line changelog entries, so there’s no detail yet on how they were found or how practical either is to exploit.