{"id":"CVE-2026-88968","aliases":["GHSA-5xjx-9qx6-jcrv"],"url":"https://o3.security/vulnerability/CVE-2026-88968","summary":"Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace","details":"Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could exploit the resulting time-of-check to time-of-use window by atomically swapping an in-workspace parent directory with a symlink after validation completed, causing the unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. Exploiting this required the ability to run attacker-controlled code inside the sandbox, such as through a malicious repository or dependency script.\n\nUsers on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.\n\nClaude Code thanks hackerone.com/mahoraga007 (Sunder Singh) for reporting this issue.","published":"2026-11-03T20:08:47.362Z","modified":"2026-11-05T03:31:29.568064420Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"2.1.251"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.251"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88968.json"},{"type":"ADVISORY","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88968"},{"type":"PACKAGE","url":"https://github.com/anthropics/claude-code"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:31:29.568064420Z"}}