{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-B377517B",
  "slug": "cve-2026-88968-claude-code-edit-tool-race-macos",
  "title": "Claude Code on macOS: a script inside the Bash sandbox could race the Edit tool into overwriting files outside the workspace (CVE-2026-88968)",
  "aliases": [
    "GHSA-5xjx-9qx6-jcrv",
    "Claude Code Edit tool TOCTOU",
    "Claude Code symlink race",
    "@anthropic-ai/claude-code 2.1.251 security fix",
    "Claude Code sandbox file write outside workspace"
  ],
  "summary": "CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, High, CVSS 4.0 7.7) affects @anthropic-ai/claude-code before 2.1.251. Claude Code validated Edit tool targets with point-in-time pathname and symlink resolution that was not bound to directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could swap an in-workspace parent directory for a symlink after validation, so the unsandboxed Edit implementation overwrote an attacker-selected user-writable file outside the workspace. Exploitation requires attacker-controlled code already running in the sandbox, such as from a malicious repository or dependency script. The fix shipped in 2.1.251 on 2026-08-28; the advisory was published on the anthropics/claude-code repository on 2026-10-26, on NVD on 2026-11-03 and as a GitHub reviewed advisory on 2026-11-09. Not on CISA KEV and no reported exploitation.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "The advisory names the Edit tool on macOS. The 2.1.251 release notes describe a broader fix for Read, Write and Edit following a symlink swapped after the permission check; HOL has not tested whether Read and Write were exploitable in the same way. NVD analysis was still pending at publication.",
  "firstObservedAt": "2026-08-28T15:34:26.000Z",
  "lastObservedAt": "2026-11-10T14:13:59.000Z",
  "publishedAt": "2026-11-10T14:21:21.986Z",
  "reviewedAt": "2026-11-10T14:21:06.398Z",
  "expiresAt": "2026-11-10T14:13:59.000Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "vendor-advisory",
      "label": "GHSA-5xjx-9qx6-jcrv: Claude Code TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace",
      "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-26T11:43:04Z"
    },
    {
      "id": "github-advisory",
      "label": "GitHub reviewed advisory GHSA-5xjx-9qx6-jcrv",
      "url": "https://github.com/advisories/GHSA-5xjx-9qx6-jcrv",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-11-09T22:42:03Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-88968",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88968",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-11-03T20:18:19Z"
    },
    {
      "id": "release-2-1-251",
      "label": "Claude Code v2.1.251 release notes",
      "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.251",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-08-28T18:19:32Z"
    },
    {
      "id": "npm-registry",
      "label": "npm registry: @anthropic-ai/claude-code",
      "url": "https://www.npmjs.com/package/@anthropic-ai/claude-code",
      "sourceType": "other_primary",
      "observedAt": "2026-11-10T14:13:59.000Z"
    },
    {
      "id": "setup-docs",
      "label": "Claude Code setup and auto-update documentation",
      "url": "https://code.claude.com/docs/en/setup",
      "sourceType": "other_primary",
      "observedAt": "2026-11-10T14:13:59.000Z"
    },
    {
      "id": "sandbox-docs",
      "label": "Claude Code sandboxing documentation",
      "url": "https://code.claude.com/docs/en/sandboxing",
      "sourceType": "other_primary",
      "observedAt": "2026-11-10T14:13:59.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: A booby-trapped project could make Claude Code on a Mac overwrite your other files (CVE-2026-88968)",
      "url": "https://hol.org/blog/cve-2026-88968-claude-code-edit-tool-race-macos",
      "sourceType": "other_primary",
      "observedAt": "2026-11-10T14:13:59Z"
    }
  ],
  "artifacts": [
    {
      "id": "claude-code-npm",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "@anthropic-ai/claude-code",
      "version": "< 2.1.251",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "fix-released-2-1-251",
      "occurredAt": "2026-08-28T15:34:26.000Z",
      "eventType": "vendor_action",
      "summary": "Claude Code 2.1.251 published to npm with a fix for file tools following a symlink swapped after the permission check.",
      "sourceIds": [
        "release-2-1-251",
        "npm-registry"
      ]
    },
    {
      "id": "vendor-advisory-published",
      "occurredAt": "2026-10-26T11:43:04.000Z",
      "eventType": "disclosure",
      "summary": "Anthropic publishes GHSA-5xjx-9qx6-jcrv on the anthropics/claude-code repository.",
      "sourceIds": [
        "vendor-advisory"
      ]
    },
    {
      "id": "nvd-record-published",
      "occurredAt": "2026-11-03T20:18:19.000Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-88968 published to NVD, awaiting analysis.",
      "sourceIds": [
        "nvd"
      ]
    },
    {
      "id": "github-reviewed-advisory-published",
      "occurredAt": "2026-11-09T22:42:03.000Z",
      "eventType": "disclosure",
      "summary": "GitHub reviewed advisory published, feeding Dependabot and other scanners.",
      "sourceIds": [
        "github-advisory"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-11-10T14:13:59.000Z",
      "eventType": "other",
      "summary": "HOL Guard publishes an operator write-up with scope, auto-update checks and a sandbox test.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-claude-code-patch",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent commands and file access before they run. It does not patch the Claude Code Edit tool race; the fix is updating Claude Code to 2.1.251 or later."
    }
  ],
  "policies": [],
  "limitations": [
    "Users who never enabled Claude Code's Bash sandbox are outside this advisory's scope; the sandbox is off by default.",
    "The advisory describes exploitation on macOS only; Linux and WSL2 use a bubblewrap sandbox and native Windows runs commands unsandboxed.",
    "Standard auto-update installs received 2.1.251 automatically.",
    "Exploitation needs attacker-controlled code already running inside the sandbox; it is not remote or unauthenticated.",
    "Impact is overwriting one user-writable file outside the workspace; it is not code execution by itself."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-88968-claude-code-edit-tool-race-macos/corrections"
}