AI Threat AlertCVE-2026-103435: Claude Code: TOCTOU symlink race allows out-of-sandbox write
HIGHClaude Code checked that a file path sat inside the project directory at permission-check time, but resolved it again at write time without re-validating. An attacker with write access to the workspace could swap a project file for a symlink in that window and make the agent write outside the sandbox. The practical risk is a lower-privileged user in a shared workspace redirecting a benign agent edit onto sensitive files such as shell startup configs, which then run in the higher-privileged user's context. Exploitation is not trivial: it needs a race win and prior workspace write access. There is no known public exploit, no Nuclei template, and no KEV listing, and EPSS is not yet available. Auto-updating installs are already patched, so the action is to confirm that developer endpoints and CI runners are on the latest @anthropic-ai/claude-code release, especially where workspaces are shared. Also review shell rc files and dotfiles for unexpected modifications. The package has 20 other CVEs, so patch hygiene for this tool deserves a standing process.
What is the risk?
Severity is high per the vendor advisory (no CVSS vector published yet). Exploitability is limited by the race condition and the prerequisite of write access to the workspace. Impact is arbitrary file write outside the sandbox, with potential persistence and privilege escalation through shell configuration files. Exposure is highest on shared dev servers, multi-user build hosts, and CI runners where agents run with higher privileges than other workspace users. No active exploitation, KEV listing, public exploit, or scanner template is known.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Claude Code | npm | — | No patch |
| Claude Code | npm | — | No patch |
How severe is it?
What should I do?
1 step1) Update @anthropic-ai/claude-code to the latest version (auto-update installs already received the fix; verify with
claude --versionand check GHSA-5j29-h97v-84ch for the patched release). 2) Avoid running the agent in workspaces writable by lower-privileged or untrusted users. 3) Run the agent under a least-privilege account or in a container or VM with limited filesystem mounts. 4) Detect: monitor for symlink creation inside project directories pointing outside the tree, and file integrity monitoring on shell rc files, ~/.ssh, and git hooks. 5) Audit EDR or auditd logs for writes by the claude process to paths outside the working directory. 6) Disable manual-update pinning in CI images or refresh them regularly.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-103435?
Claude Code checked that a file path sat inside the project directory at permission-check time, but resolved it again at write time without re-validating. An attacker with write access to the workspace could swap a project file for a symlink in that window and make the agent write outside the sandbox. The practical risk is a lower-privileged user in a shared workspace redirecting a benign agent edit onto sensitive files such as shell startup configs, which then run in the higher-privileged user's context. Exploitation is not trivial: it needs a race win and prior workspace write access. There is no known public exploit, no Nuclei template, and no KEV listing, and EPSS is not yet available. Auto-updating installs are already patched, so the action is to confirm that developer endpoints and CI runners are on the latest @anthropic-ai/claude-code release, especially where workspaces are shared. Also review shell rc files and dotfiles for unexpected modifications. The package has 20 other CVEs, so patch hygiene for this tool deserves a standing process.
Is CVE-2026-103435 actively exploited?
No confirmed active exploitation of CVE-2026-103435 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-103435?
1) Update @anthropic-ai/claude-code to the latest version (auto-update installs already received the fix; verify with `claude --version` and check GHSA-5j29-h97v-84ch for the patched release). 2) Avoid running the agent in workspaces writable by lower-privileged or untrusted users. 3) Run the agent under a least-privilege account or in a container or VM with limited filesystem mounts. 4) Detect: monitor for symlink creation inside project directories pointing outside the tree, and file integrity monitoring on shell rc files, ~/.ssh, and git hooks. 5) Audit EDR or auditd logs for writes by the claude process to paths outside the working directory. 6) Disable manual-update pinning in CI images or refresh them regularly.
What systems are affected by CVE-2026-103435?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CI/CD pipelines, shared development environments.
What is the CVSS score for CVE-2026-103435?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0053AI Agent Tool InvocationAML.T0107Exploitation for Defense EvasionAML.T0112.000Local AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to hackerone.com/c_h4ck_0 for reporting this issue.
Exploitation Scenario
A contractor with write access to a shared monorepo checkout on a build server waits for a senior engineer to run Claude Code in the same workspace. While the agent is about to edit a project file, the attacker repeatedly swaps that file with a symlink pointing to the engineer's ~/.zshrc. If the swap lands between the permission check and the write, the agent writes its output into the shell config. The next time the engineer opens a shell, the injected content executes with their higher privileges.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-61UNIX Symbolic Link (Symlink) FollowingCWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
Timeline
Related Vulnerabilities
CVE-2026-26119.6MLflow: cross-origin bypass enables RCE via AI agent
Same package: claude-codeCVE-2026-732228.8Claude Code Templates: unauth RCE via shell injection
Same package: claude-codeCVE-2026-75748.7Claude Desktop: VM integrity bypass enables RCE
Same package: claude-codeCVE-2026-350208.4Claude Code CLI: OS command injection via TERMINAL env
Same package: claude-codeCVE-2026-494718.3Serena: unauth dashboard API enables RCE via memory poisoning
Same package: claude-code