CVE-2026-103435: Claude Code could follow a swapped-in symlink and write outside the project

Vulnerability · Claude Code · HIGH

Incident dateNot stated

DisclosedOct 5, 2026 (Anthropic advisory). NVD published Oct 7, 2026. Fix released May 2026 in 2.1.129.

Added hereOct 14, 8:20 AM ET

Last verifiedOct 14, 2026

Summary

Anthropic published advisory GHSA-5j29-h97v-84ch for Claude Code. When Claude Code asked permission to edit a file, it checked that the path was inside the project folder, but it looked the path up again when it wrote the file and did not repeat the check. Someone who could write to the same workspace could swap that file for a symlink in between, so the edit landed on a file outside the project, such as a shell configuration file. Claude Code 2.1.129 fixes it, and Anthropic says standard auto-update users already have the fix.

Severity

HIGH A write to an arbitrary file with the privileges of the person running Claude Code, which can lead to code execution through files like shell configuration. It needs write access to the shared workspace and winning a race against the write. Anthropic and NVD list CVSS 4.0 7.7 High.

Timeline

May 6, 2026 (UTC)
Claude Code 2.1.129 is released on GitHub. Anthropic's advisory lists it as the patched version.
Oct 5, 2026
Anthropic publishes GHSA-5j29-h97v-84ch for @anthropic-ai/claude-code: versions before 2.1.129 affected.
Oct 7, 2026
NVD publishes CVE-2026-103435.

How it happened

This is a time-of-check to time-of-use (TOCTOU) bug. The permission check and the write each resolved the file path on their own, so a symlink created between the two sent the write somewhere the check never approved. Anthropic describes the realistic case as a lower-privileged user with write access to a shared workspace redirecting harmless edits in a higher-privileged user's session, for example into shell configuration. Anthropic lists CWE-22, CWE-61 and CWE-367, and NVD lists CWE-22. Anthropic credits the HackerOne user c_h4ck_0 with the report.

How to check your app

Run claude --version and make sure you are on 2.1.129 or later.
Be careful running Claude Code in folders that other users or processes can write to, such as a shared server directory.
If you ran an older version in a shared workspace, look over files outside the project it could have written to, such as ~/.bashrc or ~/.zshrc.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.