Claude Code below 2.1.251 let code in its Bash sandbox redirect an Edit outside the workspace on macOS (CVE-2026-88968)
Claude Code's sandbox isolates shell commands, and its file tools run outside it. CVE-2026-88968, published on 2026-10-26 and fixed in 2.1.251, used the gap between the two on macOS: code running inside the Bash sandbox could swap a folder for a symlink after the Edit tool had checked the path, so the edit landed outside the workspace. It is the second time-of-check to time-of-use fix for Claude…
Claude Code, a code editor, has a sandbox that isolates shell commands and runs file tools outside the sandbox. However, a vulnerability (CVE-2026-88968) allowed code running inside the Bash sandbox to redirect an edit outside the workspace on macOS. This was due to a gap between the path validation and the path use. The vulnerability was fixed in version 2.1.251.
The first advisory about a similar issue was published on October 5, 2026, while the fix was released on October 26. The problem occurred when a process running inside the sandbox swapped an in-workspace parent directory with a symlink, causing an unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace.
To ensure you have the fix, check your version using `claude --version` and `claude doctor`. If you are on the auto-update channel, you have the latest fix. Adjust the `minimumVersion` setting to enforce using a specific version or higher.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
