high severityConfidence highHistorical record

Claude Code on macOS: a script inside the Bash sandbox could race the Edit tool into overwriting files outside the workspace (CVE-2026-88968)

Direct answer

Claude Code on macOS: a script inside the Bash sandbox could race the Edit tool into overwriting files outside the workspace (CVE-2026-88968), also tracked as GHSA-5xjx-9qx6-jcrv / Claude Code Edit tool TOCTOU / Claude Code symlink race is a high-severity threat campaign HOL Guard tracked from Aug 28, 2026 to Nov 10, 2026, verified against 8 primary sources and last reviewed Nov 10, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, High, CVSS 4.0 7.7) affects @anthropic-ai/claude-code before 2.1.251. Claude Code validated Edit tool targets with point-in-time pathname and symlink resolution that was not bound to directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could swap an in-workspace parent directory for a symlink after validation, so the unsandboxed Edit implementation overwrote an attacker-selected user-writable file outside the workspace. Exploitation requires attacker-controlled code already running in the sandbox, such as from a malicious repository or dependency script. The fix shipped in 2.1.251 on 2026-08-28; the advisory was published on the anthropics/claude-code repository on 2026-10-26, on NVD on 2026-11-03 and as a GitHub reviewed advisory on 2026-11-09. Not on CISA KEV and no reported exploitation.

Also tracked as GHSA-5xjx-9qx6-jcrv · Claude Code Edit tool TOCTOU · Claude Code symlink race · @anthropic-ai/claude-code 2.1.251 security fix · Claude Code sandbox file write outside workspace

First observed
Aug 28, 2026
Last observed
Nov 10, 2026
Last reviewed
Nov 10, 2026
Tracking ended
Nov 10, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

The advisory names the Edit tool on macOS. The 2.1.251 release notes describe a broader fix for Read, Write and Edit following a symlink swapped after the permission check; HOL has not tested whether Read and Write were exploitable in the same way. NVD analysis was still pending at publication.

  • Users who never enabled Claude Code's Bash sandbox are outside this advisory's scope; the sandbox is off by default.
  • The advisory describes exploitation on macOS only; Linux and WSL2 use a bubblewrap sandbox and native Windows runs commands unsandboxed.
  • Standard auto-update installs received 2.1.251 automatically.
  • Exploitation needs attacker-controlled code already running inside the sandbox; it is not remote or unauthenticated.
  • Impact is overwriting one user-writable file outside the workspace; it is not code execution by itself.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent commands and file access before they run. It does not patch the Claude Code Edit tool race; the fix is updating Claude Code to 2.1.251 or later.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Claude Code 2.1.251 published to npm with a fix for file tools following a symlink swapped after the permission check.

    Sources:Claude Code v2.1.251 release notes·npm registry: @anthropic-ai/claude-code

  2. Disclosure

    Anthropic publishes GHSA-5xjx-9qx6-jcrv on the anthropics/claude-code repository.

    Source:GHSA-5xjx-9qx6-jcrv: Claude Code TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

  3. Disclosure

    CVE-2026-88968 published to NVD, awaiting analysis.

    Source:NVD CVE-2026-88968

  4. Disclosure

    GitHub reviewed advisory published, feeding Dependabot and other scanners.

    Source:GitHub reviewed advisory GHSA-5xjx-9qx6-jcrv

  5. Update

    HOL Guard publishes an operator write-up with scope, auto-update checks and a sandbox test.

    Source:HOL: A booby-trapped project could make Claude Code on a Mac overwrite your other files (CVE-2026-88968)

Publication clock: 362.6 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • @anthropic-ai/claude-code@< 2.1.251npmpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, High, CVSS 0 HOL Guard tracked the campaign from Aug 28, 2026 to Nov 10, 2026.

No. Active tracking ended Nov 10, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 8 primary sources, names 1 reviewed artifact, and was last fully reviewed Nov 10, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The advisory names the Edit tool on macOS.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-B377517B