al-ice.ai

Validated, Then Swapped: CVE-2026-88968 and the Claude Code Edit-Tool TOCTOU That Escaped the Workspace

AI Vulnerabilities & CVEs by al-ice.ai Editorial

NVD published CVE-2026-88968 on 3 November 2026, scoring it CVSS 4.0 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H with no scope change) under CWE-59 (link following) and CWE-367 (time-of-check to time-of-use). The target is Claude Code before 2.1.251, Anthropic’s agentic coding tool: its Edit tool validated targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, attacker-controlled code running inside Claude Code’s Bash sandbox could atomically swap an in-workspace parent directory for a symlink after validation, causing the unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. The fix shipped in 2.1.251; the GitHub advisory (GHSA-5xjx-9qx6-jcrv) dates to 26 October, so this is a quietly-shipped fix with a delayed CVE — eight days between advisory and NVD publication, and a reporter credit to Sunder Singh (HackerOne’s mahoraga007).

The oldest race, in the newest sandbox

The advisory’s mechanism sentence is worth quoting in full because it names the exact broken invariant: resolution “not bound to the underlying directory inodes or file descriptors.” A check-then-use sequence that re-resolves a pathname will always lose to an adversary who can rename between the two steps; the standard fix is to open directories and operate relative to file descriptors (openat-style) so the validated object and the used object are provably the same one. Claude Code checked the string; the attacker replaced the directory. On macOS the swap primitive is atomic, so no timing luck is required — AT:P (attack complexity via a race window) is honest in the vector, but “present” here means reliably winnable, not probabilistic. Note the asymmetry the advisory draws: the Bash sandbox is where the attacker runs, the Edit implementation is unsandboxed where the damage lands. Sandbox boundaries that tools routinely cross on the model’s behalf are the through-line of this season’s agent escapes — from the Prefab UI Deno sandbox that launched with full host permissions to the hyper-mcp Cosign TOCTOU and the computer-use click-swap race covered earlier on this site. Same flaw family, third host process.

The precondition is the part defenders should sit with: exploitation requires attacker-controlled code running inside the sandbox, “such as through a malicious repository or dependency script.” That is not a exotic prerequisite in 2026 — it is the commodity half of nearly every incident on this site. Malicious repositories with armed agent hooks (the testmetest worm’s 42 GitHub repos), planted instructions that hijack agents on contact (the Downloads-folder AGENTS.md hijack of Codex), and a trojanized Claude Code build that shipped SSH backdoors through the Cursor marketplace all deliver exactly the “run my code in your harness” starting position this CVE needs. The TOCTOU is the escalation; the ecosystem supplies the entry. And the 2.1.251 release notes hint the audit already went wider: the same release fixed plugin marketplace entries able to point outside the plugin directory, a Workflow tool reading a scriptPath outside the session’s readable scope, and Grep/Glob ignoring Read(...) deny rules on symlinked search paths — four path-and-symlink fixes in one release, which reads like someone finally grep’d the codebase for the class instead of patching the instance.

What to actually do

  1. Update to @anthropic-ai/claude-code ≥ 2.1.251. Standard auto-update installs already carry the fix; manually updated installs should verify the version rather than assume it.
  2. Treat the sandbox-entry half as the control point: pin and review repositories, dependency install scripts and marketplace plugins before agent sessions touch them, since any of them is the TOCTOU’s required foothold.
  3. On macOS fleets, check whether sessions ran pre-2.1.251 against untrusted repos; the write target is attacker-selected and user-writable, so post-session filesystem review beats log review.
  4. Watch sibling harnesses for the same check-then-use shape: pathname validation divorced from file-descriptor-anchored use is a codebase-wide habit, and this release’s four-fix cluster suggests vendors are finding it by audit, not by report.

Our verification was read-only. We read the NVD JSON record for CVE-2026-88968 first-hand (published 3 November 2026; CVSS 4.0 7.7 with the vector quoted above; CWE-59 and CWE-367; affected before 2.1.251; references to the v2.1.251 release and GHSA-5xjx-9qx6-jcrv; record status Awaiting Analysis), the full GHSA-5xjx-9qx6-jcrv advisory via the GitHub API (severity high; published 26 October 2026; npm scope @anthropic-ai/claude-code; auto-update note; reporter credit), and the 2.1.251 release notes via the GitHub API (Edit/Read/Write symlink-swap fix line plus the plugin, Workflow and Grep/Glob sibling fixes). We installed nothing, ran no agent and swapped no symlink. Brave Search was used for discovery only.

Sources: