The flaw affects macOS when attacker-controlled code is already running inside the Bash sandbox.A successful attack may cause the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. The vendor advisory assigns a CVSS 4.0 score of 7.7.
What it allows
How Does CVE-2026-88968 Escape the Claude Code Workspace?
Affected Claude Code releases checked an Edit target through pathname and symlink resolution. That check was not bound to the underlying directory inode or file descriptor.
Attacker-controlled sandbox code could change an in-workspace parent directory after validation but before the Edit operation used it. The unsandboxed Edit implementation could then follow the changed path outside the workspace.
The attack requires attacker-controlled code to run inside the Bash sandbox. The advisory gives a malicious repository or dependency script as examples of how that prerequisite might arise.
This is a vulnerability management issue involving file-path trust across a sandbox boundary. It is separate from Claude Code secret handling or malicious extension risks.
Who is affected
The affected npm package is @anthropic-ai/claude-code before version 2.1.251. The documented vulnerable path applies to macOS and the Edit tool.
Version 2.1.251 contains the fix, so teams should include it in their patch management process. Standard auto-update users received it automatically, while manual-update users should install the latest version and verify the installed build.
What to do
-
Confirm the installed Claude Code version
Inventory macOS systems running Claude Code and verify the installed package version directly. Prioritize any build earlier than 2.1.251.
-
Update to version 2.1.251 or later
Install the fixed release or a later supported version. Users who rely on auto-update should still confirm that the update completed successfully.
-
Treat untrusted repositories as code execution risk
Review unfamiliar repositories and dependency scripts before allowing them to run. Use separate environments for untrusted code and limit access to user-writable sensitive files.
-
Review writes outside expected workspaces
Inspect endpoint and file-system telemetry for unexpected changes to user-writable files during Claude Code sessions. Preserve evidence and start incident response when unexplained writes appear.
-
Reassess sandbox boundary assumptions
Document which operations cross from sandboxed processes into unsandboxed tooling. Verify that security controls do not treat workspace path validation as the only boundary.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-88968?
It is a high-severity TOCTOU race condition in the Claude Code Edit tool. The flaw may permit writes outside the workspace on macOS.
Which Claude Code versions are affected by CVE-2026-88968?
The @anthropic-ai/claude-code npm package before version 2.1.251 is affected. Version 2.1.251 contains the fix.
What must happen before CVE-2026-88968 can be exploited?
Attacker-controlled code must already run inside the Claude Code Bash sandbox. The advisory cites a malicious repository or dependency script as examples.
What can CVE-2026-88968 change outside the workspace?
The advisory says the flaw may overwrite an attacker-selected file that the user can write. It does not grant unrestricted writes to every system location.
How should defenders remediate CVE-2026-88968?
Update Claude Code to version 2.1.251 or later and verify the installed build. Review unexpected file changes during sessions involving untrusted code.
Sources
- GitHub Advisory GHSA-5xjx-9qx6-jcrvGitHub
- NVD: CVE-2026-88968NIST NVD
