CVE-2026-88968

A symlink race can redirect Claude Code edits outside the workspace

Anthropic · Claude Code Edit tool on macOS

First documented disclosure · Review checkpoint

Summary

A sandboxed process can redirect an approved Edit operation to another file writable by the user.

Severity and exploitation evidence

High · 7.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Vendor-confirmed vulnerability. The advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Between path validation and the write, an attacker can replace a parent directory with a symlink. The unsandboxed editor then follows the changed path.

Conditions required

Attacker-controlled code, such as a repository or dependency script, is running in the Bash sandbox on macOS and can win the race during an edit.

Potential impact

The editor can overwrite a file outside the approved workspace under the user’s own permissions.

Affected versions and configurations

Claude Code before 2.1.251 for the documented macOS path.

Fix and mitigation status

2.1.251 contains the fix. Anthropic says standard automatic updates delivered it.

Practical next steps

Check the installed version on developer machines, especially manual installations. Update to a supported release containing the fix.

Operating lesson

Bind file operations to the object that passed the permission check even if another process changes the directory tree.

Evidence and limits

The August 28 release notes describe the symlink swap. The October 26 advisory narrows this CVE to the Edit write path. The CNA published November 3.

Sources