---
id: "CVE-2026-88968"
kind: "vulnerability"
aliases: ["CVE-2026-88968"]
title: "Claude Code: Edit tool symlink race lets sandboxed code overwrite files outside workspace"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-coding-agent", "ai-tooling", "claude-code", "macos"]
not_affected_if: ["non-macos", "sandbox-disabled", "version-2.1.251-or-later"]
published_at: "2026-11-03T20:18:19+00:00"
first_seen_at: "2026-11-03T20:49:23+00:00"
updated_at: "2026-11-03T20:50:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88968", "first_seen_at": "2026-11-03T20:49:23+00:00"}]
---

# Claude Code: Edit tool symlink race lets sandboxed code overwrite files outside workspace

Claude Code's Edit tool checks a target path but does not bind that check to the actual directory, so on macOS code running inside the Bash sandbox can swap a workspace directory for a symlink and make Edit write outside the workspace. An attacker gets to overwrite user-writable files outside the project, typically by planting code in a malicious repository or dependency script.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `claude --version` and compare against `2.1.251`
- Check whether you run Claude Code on macOS with the Bash sandbox enabled, since the flaw is macOS-specific
- Review untrusted repositories or dependency scripts that ran inside Claude Code sessions

## Fix

- Claude Code: upgrade to `2.1.251` or later

## Timeline

- 2026-11-03T20:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88968

## Documents

- [advisory] Vendor advisory: github.com https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv
- [fix] Release notes: github.com https://github.com/anthropics/claude-code/releases/tag/v2.1.251

## From the sources

Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_