{"type":"bundle","id":"bundle--feab1983-f402-5b7a-9dfe-075c6fa46606","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--53414b6b-8176-58f1-8601-a575349cb9a9","created":"2026-11-10T14:21:21.986Z","modified":"2026-11-10T14:21:21.986Z","name":"Claude Code on macOS: a script inside the Bash sandbox could race the Edit tool into overwriting files outside the workspace (CVE-2026-88968)","description":"CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, High, CVSS 4.0 7.7) affects @anthropic-ai/claude-code before 2.1.251. Claude Code validated Edit tool targets with point-in-time pathname and symlink resolution that was not bound to directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could swap an in-workspace parent directory for a symlink after validation, so the unsandboxed Edit implementation overwrote an attacker-selected user-writable file outside the workspace. Exploitation requires attacker-controlled code already running in the sandbox, such as from a malicious repository or dependency script. The fix shipped in 2.1.251 on 2026-08-28; the advisory was published on the anthropics/claude-code repository on 2026-10-26, on NVD on 2026-11-03 and as a GitHub reviewed advisory on 2026-11-09. Not on CISA KEV and no reported exploitation.","aliases":["GHSA-5xjx-9qx6-jcrv","Claude Code Edit tool TOCTOU","Claude Code symlink race","@anthropic-ai/claude-code 2.1.251 security fix","Claude Code sandbox file write outside workspace"],"first_seen":"2026-08-28T15:34:26.000Z","last_seen":"2026-11-10T14:13:59.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GHSA-5xjx-9qx6-jcrv: Claude Code TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv"},{"source_name":"GitHub reviewed advisory GHSA-5xjx-9qx6-jcrv","url":"https://github.com/advisories/GHSA-5xjx-9qx6-jcrv"},{"source_name":"NVD CVE-2026-88968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88968"},{"source_name":"Claude Code v2.1.251 release notes","url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.251"},{"source_name":"npm registry: @anthropic-ai/claude-code","url":"https://www.npmjs.com/package/@anthropic-ai/claude-code"},{"source_name":"Claude Code setup and auto-update documentation","url":"https://code.claude.com/docs/en/setup"},{"source_name":"Claude Code sandboxing documentation","url":"https://code.claude.com/docs/en/sandboxing"},{"source_name":"HOL: A booby-trapped project could make Claude Code on a Mac overwrite your other files (CVE-2026-88968)","url":"https://hol.org/blog/cve-2026-88968-claude-code-edit-tool-race-macos"}]}]}