CVE-2026-88968: TOCTOU Race Condition in Claude Code Edit Tool Allows Arbitrary File Overwrite

Vulnerability ID: CVE-2026-88968
CVSS Score: 7.7
Published: 2026-11-09

Claude Code prior to version 2.1.251 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its internal file manipulation tools (Edit, Write, Read). Because path validation was performed using string-based pathname and symbolic link resolution without binding to the underlying directory inodes or open file descriptors, a process running concurrently inside the macOS Bash sandbox can atomically replace an in-workspace directory with a symbolic link after validation passes. This causes the unsandboxed main process to follow the symlink and overwrite user-writable files outside the permitted workspace boundary.

TL;DR

A TOCTOU symlink race condition in Claude Code (< 2.1.251) on macOS allows attacker-controlled code running within the Bash sandbox to escape workspace restrictions and overwrite arbitrary user-writable files on the host via the unsandboxed Edit tool.

Technical Details

• Vulnerability Class: TOCTOU Race Condition (CWE-367) / Symlink Following (CWE-59)
• Affected Component: Claude Code File Tools (Edit, Write, Read)
• CVSS v4.0 Score: 7.7 High (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
• EPSS Score: 0.32% (24.86th Percentile)
• Primary Platform: macOS (Bash Sandbox Environment)
• Security Impact: Sandbox Escape & Arbitrary User-Writable File Overwrite
• Fixed Version: @anthropic-ai/claude-code 2.1.251
• CISA KEV Status: Not Listed

Affected Systems

• @anthropic-ai/claude-code on macOS
• @anthropic-ai/claude-code: < 2.1.251 (Fixed in: 2.1.251)

Code Analysis

Commit: f1af9b1

Release v2.1.251 changelog commit documenting the fix for Read, Write, and Edit tools following symlinks swapped inside the working directory after permission checks.

Mitigation Strategies

• Upgrade @anthropic-ai/claude-code to version 2.1.251 or later to enforce inode and descriptor-bound path validation.
• Avoid executing Claude Code inside untrusted or unverified third-party repositories when running versions prior to 2.1.251.
• Monitor macOS developer endpoints for anomalous high-frequency atomic directory swaps (renameatx_np with RENAME_SWAP) and unexpected modifications to user dotfiles (~/.zshrc, ~/.ssh/authorized_keys) by the claude process.

Remediation Steps:

1. Check the currently installed version of Claude Code by executing 'claude --version'.
2. If the version is earlier than 2.1.251, run 'npm update -g @anthropic-ai/claude-code' or reinstall the latest package via 'npm install -g @anthropic-ai/claude-code@latest'.
3. Confirm the update succeeded by running 'claude --version' and verifying the output is >= 2.1.251.
4. Audit host dotfiles (~/.zshrc, ~/.bashrc, ~/.ssh/authorized_keys) for unauthorized modifications if an unpatched version was previously used on untrusted repositories.

References

• GitHub Security Advisory: GHSA-5xjx-9qx6-jcrv
• NIST National Vulnerability Database: CVE-2026-88968
• CVE.org Official Record: CVE-2026-88968
• GitHub Release: @anthropic-ai/claude-code v2.1.251
• Release Commit f1af9b1f4b1fd4c776135381606edada82ef638e
• GitHub Advisory Database: GHSA-5xjx-9qx6-jcrv
• Raw CVEListV5 JSON Record: CVE-2026-88968

Read the full report for CVE-2026-88968 on our website for more details including interactive diagrams and full exploit analysis.