{
  "id": 19585854,
  "title": "Claude Code below 2.1.251 let code in its Bash sandbox redirect an Edit outside the workspace on macOS (CVE-2026-88968)",
  "url": "https://urgent.news/2026/11/12/claude-code-below-2-1-251-let-code-in-its-bash-sandbox-redirect-an",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-12T02:17:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rulestack/claude-code-below-21251-let-code-in-its-bash-sandbox-redirect-an-edit-outside-the-workspace-on-2gp4"
  },
  "original_language": "en",
  "account": "Claude Code, a code editor, has a sandbox that isolates shell commands and runs file tools outside the sandbox. However, a vulnerability (CVE-2026-88968) allowed code running inside the Bash sandbox to redirect an edit outside the workspace on macOS. This was due to a gap between the path validation and the path use. The vulnerability was fixed in version 2.1.251. The first advisory about a similar issue was published on October 5, 2026, while the fix was released on October 26. The problem occurred when a process running inside the sandbox swapped an in-workspace parent directory with a symlink, causing an unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. To ensure you have the fix, check your version using `claude --version` and `claude doctor`. If you are on the auto-update channel, you have the latest fix. Adjust the `minimumVersion` setting to enforce using a specific version or higher.",
  "summary": "Claude Code's sandbox isolates shell commands, and its file tools run outside it. CVE-2026-88968, published on 2026-10-26 and fixed in 2.1.251, used the gap between the two on macOS: code running inside the Bash sandbox could swap a folder for a symlink after the Edit tool had checked the path, so the edit landed outside the workspace. It is the second time-of-check to time-of-use fix for Claude…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}