{"id":"CVE-2026-103435","kind":"vulnerability","aliases":["CVE-2026-103435","GHSA-5j29-h97v-84ch"],"related":[],"title":"Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code","description":"Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\n\nThank you to hackerone.com/c_h4ck_0 for reporting this issue.","summary":"Claude Code checked that a file path stayed inside the project folder, then resolved the path again at write time without rechecking. An attacker with write access to the shared workspace can swap a project file for a symlink and redirect Claude Code's writes to files outside the project, such as shell configuration files.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@anthropic-ai/claude-code","fixed":["2.1.129"],"affected":"< 2.1.129","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","claude-code","cwe-22","cwe-367","cwe-61","linux","macos","npm","shared-workspace","windows"],"not_affected_if":["auto-update","single-user-workspace","version-2.1.129-or-later"],"how_to_check":"- Check the installed version with `claude --version`; versions below `2.1.129` are affected.\n- Check the npm package with `npm ls @anthropic-ai/claude-code`.","fix":"- `@anthropic-ai/claude-code` `2.1.129`\n- Update to the latest version, per the advisory.","status":"open","published_at":"2026-10-05T12:45:33+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T22:59:17+00:00","updated_at":"2026-11-09T22:59:17+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:59:17Z","model":"claude-haiku-5-5","output":{"fix":"- `@anthropic-ai/claude-code` `2.1.129`\n- Update to the latest version, per the advisory.","reach":"local","title":"Claude Code: race condition lets attackers write files outside project","impact":"high","summary":"Claude Code checked that a file path stayed inside the project folder, then resolved the path again at write time without rechecking. An attacker with write access to the shared workspace can swap a project file for a symlink and redirect Claude Code's writes to files outside the project, such as shell configuration files.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["claude-code","npm","shared-workspace","windows","macos","linux"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker overwrites arbitrary files outside project sandbox","analyst_note":"","how_to_check":"- Check the installed version with `claude --version`; versions below `2.1.129` are affected.\n- Check the npm package with `npm ls @anthropic-ai/claude-code`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auto-update","single-user-workspace","version-2.1.129-or-later"],"who_is_affected":"Teams running Claude Code on a shared workspace where a lower-privileged user can write to project files alongside a higher-privileged session. Standard auto-updated installs already have the fix; manual installs below the fixed version are exposed. Single-user machines with no shared write access are at much lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4831,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103435':16A,24A '-2026':15A,23A '-22':36B '-367':38B '-61':40B '/c_h4ck_0':256C '/claude-code':28A '5j29':19A '84ch':21A 'abil':187C 'access':74B,199C 'advis':244C 'ai':27A,30B 'ai-tool':29B 'allow':147C 'alreadi':238C 'anthropic':26A 'anthropic-ai':25A 'arbitrari':1A,178C 'atom':157C 'attack':71B,149C,209C 'auto':232C 'auto-upd':231C 'benign':212C 'caus':165C 'check':50B,120C,139C 'claud':12A,33B,48B,89B,103C,166C,229C 'claude-cod':32B 'code':13A,34B,49B,90B,104C,167C,230C 'condit':192C 'configur':101B,219C 'could':151C 'cve':14A,22A 'cwe':35B,37B,39B 'directori':116C 'e.g':217C 'edit':213C 'enabl':204C 'exploit':184C 'file':2A,53B,83B,94B,102B,109C,161C,179C,216C 'fix':237C 'folder':59B 'follow':9A,169C 'gap':146C 'ghsa':18A 'ghsa-5j29-h97v-84ch':17A 'h97v':20A 'hackerone.com':255C 'hackerone.com/c_h4ck_0':254C 'higher':223C 'higher-privileg':222C 'insid':56B 'issu':260C 'latest':249C 'linux':41B 'lower':207C 'lower-privileg':206C 'maco':42B 'manual':241C 'npm':43B 'oper':196C 'output':175C 'outsid':95B,180C 'path':54B,63B,110C,127C 'perform':240C 'permiss':119C 'permission-check':118C 'privileg':208C,224C 'project':58B,82B,97B,114C,160C,182C 'race':191C 're':124C 're-resolv':123C 'receiv':235C 'recheck':69B 'redirect':88B,211C 'repeat':132C 'replac':158C 'report':258C 'requir':185C 'resid':111C 'resolv':61B,125C 'sandbox':183C 'sensit':215C 'session':225C 'share':45B,77B,202C 'shared-workspac':44B 'shell':100B,218C 'standard':228C 'stay':55B 'swap':80B 'symlink':8A,86B,164C,171C 'target':108C 'thank':251C 'time':7A,67B,121C,130C,137C,142C 'time-of-check':136C 'time-of-us':141C 'toctou':10A,145C 'tool':31B 'updat':233C,242C,246C 'use':144C 'user':226C,239C 'valid':105C,134C 'version':250C 'via':4A 'win':189C 'window':47B 'within':112C 'without':68B,131C 'work':115C 'workspac':46B,78B,155C,203C 'write':3A,6A,66B,73B,92B,129C,152C,173C,195C,198C 'write-tim':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running Claude Code on a shared workspace where a lower-privileged user can write to project files alongside a higher-privileged session. Standard auto-updated installs already have the fix; manual installs below the fixed version are exposed. Single-user machines with no shared write access are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["claudecode"],"ptokens":["ai","anthropic","claude","code"],"labels":["aitooling","claudecode","cwe22","cwe367","cwe61","high","linux","macos","npm","sharedworkspace","windows"],"campaign_type":null,"search_a":"'-103435':16A,24A '-2026':15A,23A '/claude-code':28A '5j29':19A '84ch':21A 'ai':27A 'anthropic':26A 'anthropic-ai':25A 'arbitrari':1A 'claud':12A 'code':13A 'cve':14A,22A 'file':2A 'follow':9A 'ghsa':18A 'ghsa-5j29-h97v-84ch':17A 'h97v':20A 'symlink':8A 'time':7A 'toctou':10A 'via':4A 'write':3A,6A 'write-tim':5A","search_b":"'-22':36B '-367':38B '-61':40B 'access':74B 'ai':30B 'ai-tool':29B 'attack':71B 'check':50B 'claud':33B,48B,89B 'claude-cod':32B 'code':34B,49B,90B 'configur':101B 'cwe':35B,37B,39B 'file':53B,83B,94B,102B 'folder':59B 'insid':56B 'linux':41B 'maco':42B 'npm':43B 'outsid':95B 'path':54B,63B 'project':58B,82B,97B 'recheck':69B 'redirect':88B 'resolv':61B 'share':45B,77B 'shared-workspac':44B 'shell':100B 'stay':55B 'swap':80B 'symlink':86B 'time':67B 'tool':31B 'window':47B 'without':68B 'workspac':46B,78B 'write':66B,73B,92B","search_c":"'/c_h4ck_0':256C 'abil':187C 'access':199C 'advis':244C 'allow':147C 'alreadi':238C 'arbitrari':178C 'atom':157C 'attack':149C,209C 'auto':232C 'auto-upd':231C 'benign':212C 'caus':165C 'check':120C,139C 'claud':103C,166C,229C 'code':104C,167C,230C 'condit':192C 'configur':219C 'could':151C 'directori':116C 'e.g':217C 'edit':213C 'enabl':204C 'exploit':184C 'file':109C,161C,179C,216C 'fix':237C 'follow':169C 'gap':146C 'hackerone.com':255C 'hackerone.com/c_h4ck_0':254C 'higher':223C 'higher-privileg':222C 'issu':260C 'latest':249C 'lower':207C 'lower-privileg':206C 'manual':241C 'oper':196C 'output':175C 'outsid':180C 'path':110C,127C 'perform':240C 'permiss':119C 'permission-check':118C 'privileg':208C,224C 'project':114C,160C,182C 'race':191C 're':124C 're-resolv':123C 'receiv':235C 'redirect':211C 'repeat':132C 'replac':158C 'report':258C 'requir':185C 'resid':111C 'resolv':125C 'sandbox':183C 'sensit':215C 'session':225C 'share':202C 'shell':218C 'standard':228C 'symlink':164C,171C 'target':108C 'thank':251C 'time':121C,130C,137C,142C 'time-of-check':136C 'time-of-us':141C 'toctou':145C 'updat':233C,242C,246C 'use':144C 'user':226C,239C 'valid':105C,134C 'version':250C 'win':189C 'within':112C 'without':131C 'work':115C 'workspac':155C,203C 'write':129C,152C,173C,195C,198C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-05T12:45:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"98a01053-8a31-4f6d-9aa9-252be161adc6","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-5j29-h97v-84ch","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch","severity":"high","published_at":"2026-10-05T12:45:33+00:00","modified_at":"2026-10-05T12:45:33+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-103435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103435","severity":null,"published_at":"2026-10-07T13:17:16+00:00","modified_at":"2026-10-07T15:16:57+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110599,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-05T12:45:33+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}