CVE-2026-88968: Claude Code: TOCTOU symlink race lets sandbox escape file write

HIGH

Published November 3, 2026

CISO Take

Claude Code's Edit tool checks a file path for safety but does not bind that check to the actual directory, so code running inside the Bash sandbox on macOS can swap a parent folder for a symlink after validation and make the unsandboxed Edit tool overwrite a user-writable file outside the workspace. This breaks the sandbox boundary that developers rely on when opening untrusted repositories or running dependency scripts. Exploitation needs attacker-controlled code to already run in the sandbox and a precisely timed race. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so near-term mass exploitation is unlikely, but the vendor confirms the flaw (GHSA-5xjx-9qx6-jcrv) and the package has 25 other CVEs. Upgrade claude-code to 2.1.251 or later on all macOS developer machines, and treat untrusted repositories with extra caution until patched.

Sources:NVDGitHub AdvisoryATLASEPSSCISA KEV

What is the risk?

High severity but with narrowing conditions: it affects macOS only, requires attacker-controlled code inside the Bash sandbox (for example from a malicious repository or dependency script), and needs a successful race condition (CWE-367) combined with link following (CWE-59). No CVSS vector, EPSS score or public exploit is available, and it is not in CISA KEV. The impact is arbitrary overwrite of any user-writable file outside the workspace, such as shell profiles, SSH config or Git hooks, which can lead to persistent code execution as the user. Exposure is concentrated on developer workstations, which often hold source code, cloud credentials and tokens.

How does the attack unfold?

Initial Access

Victim opens a malicious repository or dependency whose script runs in the Claude Code Bash sandbox on macOS.

AML.T0011.001

Race Exploitation

Sandboxed code atomically replaces an in-workspace parent directory with a symlink after the Edit tool validates the path.

AML.T0053

Sandbox Escape

The unsandboxed Edit implementation follows the symlink and writes to a user-writable file outside the workspace.

AML.T0105

Impact

Overwritten shell profile or config files give persistent code execution and access to developer secrets.

AML.T0112.000

Initial Access

Victim opens a malicious repository or dependency whose script runs in the Claude Code Bash sandbox on macOS.

AML.T0011.001

Race Exploitation

Sandboxed code atomically replaces an in-workspace parent directory with a symlink after the Edit tool validates the path.

AML.T0053

Sandbox Escape

The unsandboxed Edit implementation follows the symlink and writes to a user-writable file outside the workspace.

AML.T0105

Impact

Overwritten shell profile or config files give persistent code execution and access to developer secrets.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Claude Code	npm	—	No patch
154.1KPushed 4d ago59% patched~5d to patchFull package profile →

Do you use Claude Code? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade claude-code to 2.1.251 or later (npm update, then verify with claude --version) across all macOS developer machines and managed images. 2) Until patched, avoid opening untrusted repositories or running unreviewed dependency scripts with Claude Code. 3) Review and tighten permission settings so Edit and Bash actions require approval for unfamiliar projects. 4) Monitor for unexpected modifications to shell startup files (.zshrc, .zprofile), ~/.ssh/config, Git hooks and LaunchAgents, and for symlink swaps of directories inside workspaces. 5) Use endpoint detection to alert on rapid directory-to-symlink replacement patterns by processes spawned from Claude Code.

How is it classified?

Code ExecutionSupply ChainAgentPluginAML.T0011.001- Malicious Package AML.T0053- AI Agent Tool Invocation AML.T0105- Escape to Host AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-88968?

Is CVE-2026-88968 actively exploited?

No confirmed active exploitation of CVE-2026-88968 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-88968?

1) Upgrade claude-code to 2.1.251 or later (npm update, then verify with claude --version) across all macOS developer machines and managed images. 2) Until patched, avoid opening untrusted repositories or running unreviewed dependency scripts with Claude Code. 3) Review and tighten permission settings so Edit and Bash actions require approval for unfamiliar projects. 4) Monitor for unexpected modifications to shell startup files (.zshrc, .zprofile), ~/.ssh/config, Git hooks and LaunchAgents, and for symlink swaps of directories inside workspaces. 5) Use endpoint detection to alert on rapid directory-to-symlink replacement patterns by processes spawned from Claude Code.

What systems are affected by CVE-2026-88968?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, sandboxed tool execution.

What is the CVSS score for CVE-2026-88968?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsdeveloper workstationssandboxed tool execution

MITRE ATLAS Techniques

AML.T0011.001Malicious Package

AML.T0053AI Agent Tool Invocation

AML.T0105Escape to Host

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.

Exploitation Scenario

An attacker publishes a repository or npm dependency with a postinstall script. A developer on macOS opens it in Claude Code and the agent runs the script inside the Bash sandbox. The script loops, repeatedly replacing an in-workspace parent directory with a symlink pointing at the user's home directory while the agent performs an edit on a path inside that directory. When the swap lands after the Edit tool's validation, the unsandboxed Edit writes attacker-influenced content to a file such as ~/.zshrc, giving persistent code execution outside the sandbox.

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition CWE-59Improper Link Resolution Before File Access

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.