AI Threat Alert
CVE-2026-39861: Claude Code: sandbox escape via symlink allows arbitrary write
GHSA-vp62-r36r-9xqp HIGHClaude Code versions prior to 2.1.64 contain a sandbox escape where sandboxed processes can create symlinks targeting locations outside the workspace; when the main unsandboxed process subsequently writes through those symlinks, it bypasses workspace restrictions and writes to arbitrary filesystem locations. This is a chained vulnerability — neither component can independently write outside the workspace — but their combination enables reliable exploitation when an attacker can inject untrusted content into the Claude Code context window. With EPSS placing this in the top 64th percentile and Claude Code widely deployed in developer workflows that routinely process third-party repositories and untrusted inputs, organizations running automated coding pipelines face concrete risk of host-level compromise via credential file overwrites or cron-based persistence mechanisms. Update to version 2.1.64 immediately; users on auto-update are already protected.
What is the risk?
High risk for teams running Claude Code in automated or semi-automated pipelines processing untrusted content. The exploitation chain requires prompt injection to trigger sandboxed code execution, adding moderate complexity, but the technique is reliable once achieved. Claude Code typically runs with developer-level filesystem permissions, making host compromise highly impactful. No public exploit exists and CISA rates it TRACK, but the prompt-injection-to-sandbox-escape chain represents a meaningful escalation in AI agent attack surface that has no equivalent in traditional tooling.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Claude Code | npm | < 2.1.64 | 2.1.64 |
| Claude Code | npm | — | No patch |
How severe is it?
What should I do?
5 steps-
Update @anthropic-ai/claude-code to version 2.1.64 or later immediately — auto-update users are already protected.
-
Manual installs: run
npm update -g @anthropic-ai/claude-codeor equivalent package manager update. -
Until patched, restrict Claude Code usage to trusted content only and avoid processing untrusted repositories or user-supplied files in automated contexts.
-
Monitor for unexpected file modifications outside workspace directories using auditd, inotifywait, or equivalent host-based file integrity monitoring.
-
As defense-in-depth, run Claude Code in containerized environments with minimal filesystem privileges and explicit bind-mounts limiting accessible paths.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-39861?
Claude Code versions prior to 2.1.64 contain a sandbox escape where sandboxed processes can create symlinks targeting locations outside the workspace; when the main unsandboxed process subsequently writes through those symlinks, it bypasses workspace restrictions and writes to arbitrary filesystem locations. This is a chained vulnerability — neither component can independently write outside the workspace — but their combination enables reliable exploitation when an attacker can inject untrusted content into the Claude Code context window. With EPSS placing this in the top 64th percentile and Claude Code widely deployed in developer workflows that routinely process third-party repositories and untrusted inputs, organizations running automated coding pipelines face concrete risk of host-level compromise via credential file overwrites or cron-based persistence mechanisms. Update to version 2.1.64 immediately; users on auto-update are already protected.
Is CVE-2026-39861 actively exploited?
No confirmed active exploitation of CVE-2026-39861 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-39861?
1. Update @anthropic-ai/claude-code to version 2.1.64 or later immediately — auto-update users are already protected. 2. Manual installs: run `npm update -g @anthropic-ai/claude-code` or equivalent package manager update. 3. Until patched, restrict Claude Code usage to trusted content only and avoid processing untrusted repositories or user-supplied files in automated contexts. 4. Monitor for unexpected file modifications outside workspace directories using auditd, inotifywait, or equivalent host-based file integrity monitoring. 5. As defense-in-depth, run Claude Code in containerized environments with minimal filesystem privileges and explicit bind-mounts limiting accessible paths.
What systems are affected by CVE-2026-39861?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer tooling, CI/CD pipelines, agentic coding workflows.
What is the CVSS score for CVE-2026-39861?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0051.001 Indirect AML.T0053 AI Agent Tool Invocation AML.T0080 AI Agent Context Poisoning AML.T0105 Escape to Host AML.T0112.000 Local AI Agent Compliance Controls Affected
What are the technical details?
Original Advisory
Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.
Exploitation Scenario
An attacker publishes a malicious open-source repository containing a prompt injection payload embedded in a README, docstring, or inline comment. When a developer opens this repository in Claude Code and begins working with it, the injected prompt instructs the sandbox to execute a script that creates a symlink from a workspace-internal path (e.g., `./output/config.json`) to a sensitive host location such as `~/.ssh/authorized_keys`. When Claude Code's main unsandboxed process subsequently writes output or configuration data to that workspace path, it follows the symlink and overwrites the SSH authorized_keys file with an attacker-controlled public key — granting persistent remote access to the developer's machine without any direct sandbox policy violation by either component individually.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-61 UNIX Symbolic Link (Symlink) Following
Primary
CWE-61 UNIX Symbolic Link (Symlink) Following
Primary
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-2611 9.6 MLflow: cross-origin bypass enables RCE via AI agent
Same package: claude-code CVE-2026-35020 8.4 Claude Code CLI: OS command injection via TERMINAL env
Same package: claude-code CVE-2026-44246 7.2 nnU-Net: prompt injection hijacks CI/CD triage agent
Same package: claude-code CVE-2026-47128 6.1 nono-cli: sandbox escape via Unix socket bypass
Same package: claude-code CVE-2026-40068 Claude Code: git worktree trust bypass executes hooks
Same package: claude-code