Claude Code Edit tool race allows writes outside the workspace
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Claude Code before 2.1.251 has a TOCTOU race in its Edit tool (CWE-367). On macOS, code in the Bash sandbox can swap an in-workspace parent directory for a symlink after validation, so the Edit tool overwrites a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| anthropics | claude-code | before 2.1.251 | 2.1.251 | Patch available | CNA |
- claude-code Vendoranthropics Affected before 2.1.251 Fixed in 2.1.251 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:*:*:* | — | — | anthropics |
- cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:*:*:* Versions — — ·anthropics
Remediation
Upgrade Claude Code to version 2.1.251, which fixes the issue. Red Hat rates it Important and lists Red Hat OpenShift Dev Spaces as affected, with the plan none available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA claude-code (anthropics) Fixed in 2.1.251
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
Timeline
- 2026-11-03 Threatist record created from CVE-2026-88968
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
More anthropics vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
- TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
- TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
- TI-2025-24240 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling CVSS 4.0CRITICAL 9.3
- TI-2025-32918 Claude Code IDE extensions allow websocket connections from arbitrary origins CVSS 4.0HIGH 8.8
Sources
- CVE-2026-88968 · CVE Program
- CVE-2026-88968 · NVD
- FIRST EPSS
- CVE-2026-88968 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences