CVE-2026-88968highAgent hijacking2026-10-26

CVE-2026-88968: Claude Code before 2.1.251 on macOS let code in the Bash sandbox trick the Edit tool into overwriting files outside the workspace

Claude Code's Edit tool checked its target path with a one-time pathname and symlink resolution that was not tied to the real directory. On macOS, code running inside Claude Code's Bash sandbox, for example from a malicious repository or dependency script, could swap a workspace folder for a symlink right after the check, so the unsandboxed Edit tool overwrote a user-writable file outside the workspace. Fixed in 2.1.251.

01.

What it is

The Edit tool validated targets using point-in-time path and symlink resolution that was not bound to directory inodes or file descriptors, leaving a time-of-check to time-of-use window.

On macOS, a process inside the Bash sandbox could atomically replace an in-workspace parent directory with a symlink after validation, and the Edit implementation, which runs outside the sandbox, then wrote to an attacker-chosen file outside the workspace.

Exploitation needs attacker-controlled code running in the sandbox, such as a malicious repository or a dependency's install or build script, which is exactly what the sandbox is meant to contain.

Anthropic says users on standard auto-update already received the fix; manual updaters need to update.

02.

How to check

Run claude --version; anything before 2.1.251 is affected.
The risk is highest if you use Claude Code on macOS in repositories or with dependencies you don't fully trust.

03.

How to fix

Update Claude Code to 2.1.251 or later (auto-update does this; with npm, install the latest @anthropic-ai/claude-code).
Until then, don't run Claude Code in untrusted repositories.

claude --version
npm install -g @anthropic-ai/claude-code@latest

04.

Sources

More advisories for this tool