Read the docs
TI-2026-69123 Aliases CVE-2026-103435

Claude Code Arbitrary File Write via TOCTOU Symlink Following

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Claude Code checked that a target file path was inside the project working directory at permission-check time, but resolved the path again at write time without repeating that check. An attacker with write access to the shared workspace who wins a race can atomically replace a project file with a symlink, so Claude Code follows the link and writes its output to an arbitrary file outside the project sandbox. The CNA rates this HIGH (CVSS 4.0 base score 7.7). Affected are @anthropic-ai/claude-code versions before 2.1.129, and the weaknesses are CWE-22, CWE-367 and CWE-61.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to hackerone.com/c_h4ck_0 for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed @anthropic-ai/claude-code (Anthropic): 2.1.129Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anthropics@anthropic-ai/claude-codebefore 2.1.1292.1.129Patch availableCNA
  • @anthropic-ai/claude-code Vendoranthropics Affected before 2.1.129 Fixed in 2.1.129 Patch available CNA

Remediation

Update @anthropic-ai/claude-code to 2.1.129 or later. Standard auto-update installs the fix already; users who update manually should move to the latest version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA @anthropic-ai/claude-code (Anthropic) Fixed in 2.1.129

Red Hat 1 advisory

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 1 product
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-103435
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-07 CVSS score added · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  7. 2026-10-30 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat

References

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
  • TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
  • TI-2025-24240 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling CVSS 4.0CRITICAL 9.3
  • TI-2025-32918 Claude Code IDE extensions allow websocket connections from arbitrary origins CVSS 4.0HIGH 8.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences