CVE-2026-88968

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.251

Description The Edit tool validates targets using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, code controlled by an attacker running within the Bash sandbox can atomically replace a parent directory in the workspace with a symlink after validation. This allows the unsandboxed Edit implementation to overwrite a user-writable file located outside the workspace. This requires attacker-controlled code to be executing inside the sandbox, such as through a malicious repository or dependency script.

Recommendations Update to version 2.1.251.