{"id":"CVE-2026-88968","kind":"vulnerability","aliases":["CVE-2026-88968"],"related":[],"title":"Claude Code: Edit tool symlink race lets sandboxed code overwrite files outside workspace","description":"Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.","summary":"Claude Code's Edit tool checks a target path but does not bind that check to the actual directory, so on macOS code running inside the Bash sandbox can swap a workspace directory for a symlink and make Edit write outside the workspace. An attacker gets to overwrite user-writable files outside the project, typically by planting code in a malicious repository or dependency script.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","claude-code","macos"],"not_affected_if":["non-macos","sandbox-disabled","version-2.1.251-or-later"],"how_to_check":"- Run `claude --version` and compare against `2.1.251`\n- Check whether you run Claude Code on macOS with the Bash sandbox enabled, since the flaw is macOS-specific\n- Review untrusted repositories or dependency scripts that ran inside Claude Code sessions","fix":"- Claude Code: upgrade to `2.1.251` or later","status":"open","published_at":"2026-11-03T20:18:19+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:50:03+00:00","updated_at":"2026-11-03T20:50:03+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-03T20:50:03Z","model":"claude-haiku-5-5","output":{"fix":"- Claude Code: upgrade to `2.1.251` or later","reach":"local","title":"Claude Code: Edit tool symlink race lets sandboxed code overwrite files outside workspace","impact":"high","summary":"Claude Code's Edit tool checks a target path but does not bind that check to the actual directory, so on macOS code running inside the Bash sandbox can swap a workspace directory for a symlink and make Edit write outside the workspace. An attacker gets to overwrite user-writable files outside the project, typically by planting code in a malicious repository or dependency script.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["claude-code","macos","ai-coding-agent"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker overwrites user-writable files outside the workspace on the developer machine","analyst_note":"","how_to_check":"- Run `claude --version` and compare against `2.1.251`\n- Check whether you run Claude Code on macOS with the Bash sandbox enabled, since the flaw is macOS-specific\n- Review untrusted repositories or dependency scripts that ran inside Claude Code sessions","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.1.251-or-later","non-macos","sandbox-disabled"],"who_is_affected":"Developers running Claude Code on macOS, where the Bash sandbox and the unsandboxed Edit tool interact. Exploitation needs attacker-controlled code already running inside the sandbox, such as from a malicious repository or dependency script. Teams on Linux or Windows, or on versions 2.1.251 and later, are not exposed by this issue.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4235,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-88968':16A,19A '2.1.251':106C,196C 'actual':48B 'agent':23B,101C 'ai':21B,25B 'ai-coding-ag':20B 'ai-tool':24B 'atom':142C 'attack':75B,133C,173C 'attacker-control':132C,172C 'bash':57B,139C 'bind':43B 'bound':121C 'caus':155C 'check':36B,45B 'claud':1A,28B,31B,97C 'claude-cod':27B 'code':2A,9A,22B,29B,32B,53B,89B,98C,102C,135C,175C 'control':134C,174C 'cve':14A,17A 'depend':95B,188C 'descriptor':129C 'directori':49B,63B,125C,149C 'edit':3A,34B,69B,108C,158C 'exploit':170C 'file':11A,82B,128C,166C 'fix':193C 'get':76B 'implement':159C 'in-workspac':145C 'inod':126C 'insid':55B,178C 'issu':191C 'let':7A 'maco':30B,52B,131C 'make':68B 'malici':92B,185C 'outsid':12A,71B,83B,167C 'overwrit':10A,78B,161C 'parent':148C 'path':39B 'pathnam':114C 'plant':88B 'prior':104C 'project':85B 'race':6A 'replac':143C 'repositori':93B,186C 'requir':171C 'resolut':117C 'run':54B,136C,177C 'sandbox':8A,58B,140C,180C 'script':96B,189C 'swap':60B 'symlink':5A,66B,116C,152C 'target':38B,112C 'tool':4A,26B,35B,103C,109C 'typic':86B 'under':124C 'unsandbox':157C 'use':113C 'user':80B,164C 'user-writ':79B,163C 'valid':110C,154C 'version':195C 'workspac':13A,62B,73B,147C,169C 'writabl':81B,165C 'write':70B","nicknames":[],"mitigations":[],"who_affected":"Developers running Claude Code on macOS, where the Bash sandbox and the unsandboxed Edit tool interact. Exploitation needs attacker-controlled code already running inside the sandbox, such as from a malicious repository or dependency script. Teams on Linux or Windows, or on versions 2.1.251 and later, are not exposed by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aicodingagent","aitooling","claudecode","high","macos"],"campaign_type":null,"first_public_at":"2026-10-26T11:43:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88968","severity":null,"published_at":"2026-11-03T20:18:19+00:00","modified_at":"2026-11-03T20:33:04+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60623,"url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.251","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60624,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T11:43:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}