CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
In short
Claude Code's sandbox could be escaped through symlinks: a malicious script inside the sandbox creates a shortcut to a location outside the workspace, then Claude Code follows that shortcut and writes files outside the sandbox without asking permission. This could let attackers execute code on your computer.
Technical detail
Path traversal vulnerability (CWE-22, CWE-61) in Claude Code versions prior to 2.1.64 where the sandbox fails to validate symlinks during file write operations. An attacker can inject malicious prompts to trigger sandboxed code execution that creates symlinks pointing outside the workspace; the unsandboxed process then follows these symlinks and writes arbitrary files outside the intended boundary, potentially achieving code execution. Exploitation requires prompt injection to execute untrusted code within the sandbox context.
Summary generated and translated by AI from the official description.
Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N