Disclosed weakness · no CVE recorded

Sandboxed commands could write into the native updater’s download folder

Anthropic · Claude Code · Native updater download directory

First documented disclosure · Review checkpoint

Summary

In some configurations the command sandbox permitted writes to the updater’s download directory.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The vendor release notes report a fix and identify no exploitation against users.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

In some configurations the command sandbox permitted writes to the updater’s download directory.

Conditions required

A command runs inside an affected sandbox. The vendor did not enumerate all configurations.

Potential impact

A sandboxed process could write outside the intended boundary. The notes do not establish that an update was replaced or executed.

Affected versions and configurations

Anthropic did not publish the earliest affected version.

Fix and mitigation status

Anthropic lists the correction in 2.1.325.

Practical next steps

Update Claude Code to a supported release containing the 2.1.325 correction.

Operating lesson

Check that update directories are writable only by the process responsible for installing updates.

Evidence and limits

The November 13 release provides no issue-specific CVE or severity. Its change to the default approval flow for sandboxed Bash is documented separately.

Sources