- Severity: HIGH
- CVE: CVE-2026-88968
- Ecosystems: npm
- Packages: @anthropic-ai/claude-code
Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, a process running inside Claude Code’s Bash sandbox could exploit the resulting time-of-check to time-of-use window by atomically swapping an in-workspace parent directory with a symlink after validation completed, causing the unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. Exploiting this required the ability to run attacker-controlled code inside the sandbox, such as through a malicious repository or dependency script.
Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/mahoraga007 (Sunder Singh) for reporting this issue.
Source: GitHub Security Advisories · 2026-11-09