Live › vulnerability › CVE-2026-88968
Claude Code's Edit tool checks a target path but does not bind that check to the actual directory, so on macOS code running inside the Bash sandbox can swap a workspace directory for a symlink and make Edit write outside the workspace. An attacker gets to overwrite user-writable files outside the project, typically by planting code in a malicious repository or dependency script.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Developers running Claude Code on macOS, where the Bash sandbox and the unsandboxed Edit tool interact. Exploitation needs attacker-controlled code already running inside the sandbox, such as from a malicious repository or dependency script. Teams on Linux or Windows, or on versions 2.1.251 and later, are not exposed by this issue.
No product ranges from the sources yet.
claude --version and compare against 2.1.2512.1.251 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.
This page as .md · .json · in your agent: get_signal("CVE-2026-88968")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.