← All incidents

CVE-2026-88968: on macOS, code inside Claude Code's sandbox could make the Edit tool overwrite files outside the workspace

Vulnerability · Claude Code · HIGH

Summary

Anthropic published advisory GHSA-5xjx-9qx6-jcrv (CVE-2026-88968) for Claude Code on Oct 26, 2026. Claude Code checked where an Edit was going by resolving the path and any symlinks at one moment, but the check was not tied to the actual folder it then wrote into. On macOS, a process running inside Claude Code's Bash sandbox could swap a folder inside the workspace for a symlink right after the check passed, so the Edit tool, which runs outside the sandbox, overwrote a file of the attacker's choosing elsewhere on the machine. Anthropic says exploiting it required running attacker-controlled code inside the sandbox, for example through a malicious repository or dependency script. Versions before 2.1.251 are affected. Anthropic says users on standard auto-update already have the fix, and 2.1.251 was released on Aug 28, 2026. We found no reports of exploitation.

Severity

Timeline

1. Aug 28, 2026 (UTC)
   Claude Code 2.1.251 is published to npm and released on GitHub. Anthropic's advisory lists it as the patched version.
2. Oct 26, 2026 (UTC)
   Anthropic publishes GHSA-5xjx-9qx6-jcrv (CVE-2026-88968) for @anthropic-ai/claude-code: versions before 2.1.251 affected.

How it happened

This is a time-of-check to time-of-use (TOCTOU) bug, similar in kind to CVE-2026-103435 earlier this year. Claude Code's Bash tool can run commands inside a sandbox, but its Edit tool writes files from the main, unsandboxed process. Before an edit, Claude Code resolved the target path and its symlinks to make sure it stayed inside the workspace. Per Anthropic, that check was not bound to the directory inodes or file descriptors it would actually write through. A process inside the sandbox could therefore atomically replace a parent folder inside the workspace with a symlink after the check, and the edit followed the symlink to a user-writable file outside it. Anthropic lists CWE-59 (link following) and CWE-367 (TOCTOU race) and credits Sunder Singh (HackerOne user mahoraga007) with the report. NVD had no record for the CVE yet on the morning of Oct 26, 2026. CVSS 4.0 7.7 High (Anthropic, GHSA-5xjx-9qx6-jcrv). NVD had no score for it on Oct 27, 2026.

How to check your app

• Run claude --version and make sure you are on 2.1.251 or later. Auto-update users should already be there; if you pin or update Claude Code by hand, update it.
• Treat the sandbox as one layer, not a guarantee. Be careful letting Claude Code run install scripts or other code from repositories and dependencies you don't trust, even with the sandbox on.
• If you ran an older version on macOS against an untrusted repo, look over files outside the project that it could have overwritten, such as ~/.zshrc, ~/.bashrc or files under ~/Library/LaunchAgents.

Sources

• Anthropic advisory GHSA-5xjx-9qx6-jcrv (CVE-2026-88968)
• Claude Code v2.1.251 release
• npm registry metadata for @anthropic-ai/claude-code

Corrections and updates

None. Re-checked against every source on Oct 26, 2026.