CVE-2026-103435: Claude Code could be raced into writing files outside the project
Claude Code checked that a file path was inside the project at permission time but resolved it again at write time. Someone who can write to a shared workspace could swap a file for a symlink and redirect Claude Code’s edits to files like your shell config.
What it is
GitHub advisory: Claude Code “validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation.”
An attacker with write access to the workspace could atomically replace a project file with a symlink, so the write lands on an arbitrary file outside the project sandbox.
Exploiting it needs both write access to the shared workspace and winning a race against the write. The realistic case is a lower-privileged user redirecting edits made in a higher-privileged session.
How to check
- Affected: @anthropic-ai/claude-code (npm) below 2.1.129.
- Anthropic says users on standard auto-update already have the fix; manual installs should check their version.
How to fix
- Update Claude Code to 2.1.129 or later.
- Avoid running Claude Code in workspaces that other, less-trusted users can write to.
claude --version
npm install -g @anthropic-ai/claude-code@latestSources
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
- highCVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution